diff --git a/.env.example b/.env.example
index dd95e80fa1..4796b1018f 100644
--- a/.env.example
+++ b/.env.example
@@ -3,3 +3,30 @@ NUXT_SESSION_PASSWORD=""
 
 # HMAC secret for image-proxy and OG image URL signing, can use `openssl rand -hex 32`
 NUXT_IMAGE_PROXY_SECRET=""
+
+# Socket (socket.dev) security data source - optional.
+# Without these, the Socket source reports itself as unavailable and the UI
+# shows its checkbox as "unavailable on this deployment"; OSV still works.
+#
+# To obtain a key: sign in at https://socket.dev, then in the dashboard go to
+# Settings -> API Tokens -> "+ Create API token" and grant it the
+# `packages:list` scope (docs: https://docs.socket.dev/reference/creating-and-managing-api-tokens).
+# That is the only scope needed - it is what the batch-purl endpoint npmx uses
+# requires. The `alerts:list`/`alerts:trend` scopes are for a different (org
+# alerts feed) endpoint and do NOT grant access here.
+# Quota note: that endpoint costs a flat 100 units per request (up to 1024
+# packages), so a default 500-units/hour token allows only ~5 fresh scans an
+# hour. To stretch that, npmx caches Socket findings per package@version for a
+# day (a published version is immutable), so overlapping and revisited
+# dependency trees are served from cache and only never-before-seen versions
+# cost a request; a quota/auth rejection also trips a short cooldown rather
+# than hammering the API.
+# NUXT_SOCKET_ORG_SLUG is your organization's slug (the `orgs/<slug>` segment
+# in the dashboard URL).
+NUXT_SOCKET_API_KEY=""
+NUXT_SOCKET_ORG_SLUG=""
+# Prefer providing the credentials above at build time: the public
+# availability flag is derived during the build, and prerendered pages (like
+# the settings page) bake it in. If the credentials only exist at runtime,
+# also set this so server-rendered pages report Socket as available:
+# NUXT_PUBLIC_SOCKET_CONFIGURED="true"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9eb942b099..18ff24fbb9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -113,6 +113,15 @@ Please use the version pinned in the `engines.node` and `packageManager` field o
    pnpm npmx-connector
    ```
 
+5. (optional) to work on the Socket security data source, copy `.env.example` to `.env` and set your own Socket credentials:
+
+   - `NUXT_SOCKET_API_KEY` — create an organization API token at [socket.dev](https://socket.dev) under **Settings → API Tokens → "+ Create API token"**, granting it the `packages:list` scope (see [Socket's token docs](https://docs.socket.dev/reference/creating-and-managing-api-tokens)). That single scope is what the batch-purl endpoint npmx uses requires; the `alerts:list`/`alerts:trend` scopes are for a different (org alerts feed) endpoint and do **not** grant access here.
+   - `NUXT_SOCKET_ORG_SLUG` — your organization's slug (the `orgs/<slug>` segment in the dashboard URL).
+
+   The key stays server-side (it is never sent to the browser). Without these, the Socket source simply reports itself as unavailable — everything else, including OSV-based vulnerability scanning, works normally.
+
+   > **Quota:** the batch-purl endpoint costs a flat 100 units per request (up to 1024 packages), so a default 500-units/hour token only covers ~5 fresh scans an hour. npmx caches Socket findings per `package@version` for a day (a published version is immutable), so overlapping and revisited trees are served from cache and only never-before-seen versions cost a request; a quota/auth rejection also trips a short cooldown, so an exhausted token degrades to OSV-only rather than erroring repeatedly.
+
 ## Development workflow
 
 ### Available commands
diff --git a/app/assets/logos/security-sources/osv-mark-dark.svg b/app/assets/logos/security-sources/osv-mark-dark.svg
new file mode 100644
index 0000000000..a411c2524e
--- /dev/null
+++ b/app/assets/logos/security-sources/osv-mark-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-42 50 460 460"><path fill="#fafafa" d="M62,447.6l65.8-68.2c2.2-.9,22.7,12,28.2,14.1,139.4,53.3,243.2-129.9,129.1-221.5-100.8-80.9-244,19.5-203.1,143.6,3.9,12,10.8,21.7,15.4,33.2l-47.1,47C-32,294.9,7.4,142.3,126.3,91.3c115-49.3,248.1,20.7,271.7,143.2,29.4,152.7-116.5,274.9-262.7,223.6-15.9-5.6-17-10.6-34.9-10.6h-38.4Z"/><ellipse fill="#e02129" cx="206.6" cy="270" rx="74.6" ry="66.5"/></svg>
diff --git a/app/assets/logos/security-sources/osv-mark-light.svg b/app/assets/logos/security-sources/osv-mark-light.svg
new file mode 100644
index 0000000000..898952fb8e
--- /dev/null
+++ b/app/assets/logos/security-sources/osv-mark-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-42 50 460 460"><path fill="#1c181a" d="M62,447.6l65.8-68.2c2.2-.9,22.7,12,28.2,14.1,139.4,53.3,243.2-129.9,129.1-221.5-100.8-80.9-244,19.5-203.1,143.6,3.9,12,10.8,21.7,15.4,33.2l-47.1,47C-32,294.9,7.4,142.3,126.3,91.3c115-49.3,248.1,20.7,271.7,143.2,29.4,152.7-116.5,274.9-262.7,223.6-15.9-5.6-17-10.6-34.9-10.6h-38.4Z"/><ellipse fill="#e02129" cx="206.6" cy="270" rx="74.6" ry="66.5"/></svg>
diff --git a/app/assets/logos/security-sources/socket.svg b/app/assets/logos/security-sources/socket.svg
new file mode 100644
index 0000000000..7795b4aee6
--- /dev/null
+++ b/app/assets/logos/security-sources/socket.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-3.027 5.721 25.279 25.279" fill-rule="nonzero" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2" role="img" aria-label="Socket"><defs><linearGradient id="socket-brand-gradient" x1="0" y1="0" x2="1" y2="0"><stop offset="0%" stop-color="#ff00aa"/><stop offset="100%" stop-color="#8c50ff"/></linearGradient></defs><path data-socket-layer="shield" fill="url(#socket-brand-gradient)" d="M18.438 8.839c.462.165.767.603.762 1.094v-.001c-.04 3.585.231 8.64-.38 10.885-1.04 4.504-4.42 8.397-8.798 10.102a1.17 1.17 0 0 1-.838.005C4.518 29.148.918 24.731.18 19.801c-.059-.311-.092-.675-.13-.984-.038-.206-.049-1.14-.049-5.167 0-1.971.001-3.099.007-3.738a1.15 1.15 0 0 1 .757-1.07c2.8-1.021 5.375-1.936 8.186-2.963l.249-.09c.249-.09.519-.091.769-.004.627.218 1.595.578 2.237.806 2.022.727 4.179 1.512 6.231 2.248"/><path data-socket-layer="bolt" fill="#ffffff" d="M9.886 9.538c.192-.314.675-.178.675.19v5.85c0 .251.204.455.456.455h2.736c.285 0 .46.312.311.555l-4.909 8.038c-.192.314-.675.179-.675-.19v-5.849a.456.456 0 0 0-.456-.456H5.288a.365.365 0 0 1-.311-.554z"/></svg>
diff --git a/app/components/Compare/FacetScatterChart.vue b/app/components/Compare/FacetScatterChart.vue
index 9c67a5b760..ddc8a4f31c 100644
--- a/app/components/Compare/FacetScatterChart.vue
+++ b/app/components/Compare/FacetScatterChart.vue
@@ -55,6 +55,7 @@ watch(
 const isDarkMode = computed(() => resolvedMode.value === 'dark')
 
 const { facetLabels } = useFacetSelection()
+const { anySourceEnabled: anySecuritySourceEnabled } = useSecuritySources()
 
 const chartableFacets = computed(() =>
   (
@@ -69,12 +70,26 @@ const chartableFacets = computed(() =>
       description: facet.description,
       chartable: facet.chartable_scatter,
     }))
-    .filter(facet => facet.chartable),
+    .filter(facet => facet.chartable)
+    // Security counts are meaningless without an enabled security source
+    .filter(
+      facet =>
+        (facet.name !== 'vulnerabilities' && facet.name !== 'supplyChainAlerts') ||
+        anySecuritySourceEnabled.value,
+    ),
 )
 
 const selectedFacetX = ref<ComparisonFacet>('downloads')
 const selectedFacetY = ref<ComparisonFacet>('installSize')
 
+// If the selected axis facet becomes unavailable (e.g. all security sources
+// were disabled), fall back to the defaults
+watchEffect(() => {
+  const available = new Set(chartableFacets.value.map(facet => facet.name))
+  if (!available.has(selectedFacetX.value)) selectedFacetX.value = 'downloads'
+  if (!available.has(selectedFacetY.value)) selectedFacetY.value = 'installSize'
+})
+
 const dataset = computed<VueUiScatterDatasetItem[]>(() =>
   buildCompareScatterChartDataset(
     props.packagesData,
diff --git a/app/components/Package/Dependencies.vue b/app/components/Package/Dependencies.vue
index 649bfb34a5..f9f26329e2 100644
--- a/app/components/Package/Dependencies.vue
+++ b/app/components/Package/Dependencies.vue
@@ -25,13 +25,24 @@ const { data: vulnTree } = useDependencyAnalysis(
   () => props.version,
 )
 
+// Only show findings from enabled security data sources
+const { effectiveSources } = useSecuritySources()
+const displayVulnTree = computed(() => {
+  if (!vulnTree.value) return null
+  return filterVulnerabilityTreeBySources(vulnTree.value, effectiveSources.value)
+})
+
 // Check if a dependency has vulnerabilities (only direct deps)
 function getVulnerableDepInfo(depName: string) {
-  if (!vulnTree.value) return null
-  return vulnTree.value.vulnerablePackages.find(p => p.name === depName && p.depth === 'direct')
+  if (!displayVulnTree.value) return null
+  return displayVulnTree.value.vulnerablePackages.find(
+    p => p.name === depName && p.depth === 'direct',
+  )
 }
 
 // Check if a dependency is deprecated (only direct deps)
+// Note: deprecation comes from npm packument data, not from security sources,
+// so it is intentionally not gated by the security-source preference
 function getDeprecatedDepInfo(depName: string) {
   if (!vulnTree.value) return null
   return vulnTree.value.deprecatedPackages.find(p => p.name === depName && p.depth === 'direct')
diff --git a/app/components/Package/SupplyChainAlerts.vue b/app/components/Package/SupplyChainAlerts.vue
new file mode 100644
index 0000000000..438a0e0c69
--- /dev/null
+++ b/app/components/Package/SupplyChainAlerts.vue
@@ -0,0 +1,215 @@
+<script setup lang="ts">
+import type { OsvSeverityLevel, SupplyChainAlertType } from '#shared/types/dependency-analysis'
+import { SEVERITY_COLORS } from '#shared/utils/severity'
+
+const props = defineProps<{
+  packageName: string
+  version: string
+}>()
+
+// Shares the cached fetch with PackageVulnerabilityTree
+const { data: vulnTree, status } = useDependencyAnalysis(
+  () => props.packageName,
+  () => props.version,
+)
+
+const { effectiveSources, anySourceEnabled } = useSecuritySources()
+
+// Display filter: only show alerts from enabled security data sources.
+// The no-sources warning is rendered by PackageVulnerabilityTree; this
+// component simply renders nothing in that state.
+const alertPackages = computed(() => {
+  if (!anySourceEnabled.value || !vulnTree.value) return []
+  return filterVulnerabilityTreeBySources(vulnTree.value, effectiveSources.value)
+    .supplyChainPackages
+})
+
+// Supply-chain alerts come exclusively from Socket. When the user has Socket
+// enabled but the scan produced nothing (outage, quota, misconfiguration),
+// say so instead of rendering nothing - silence would read as "all clear".
+const socketScanFailed = computed(() => {
+  if (!vulnTree.value || !effectiveSources.value.socket) return false
+  const socketStatus = vulnTree.value.sourceStatus.socket
+  return socketStatus !== 'ok' && socketStatus !== 'partial'
+})
+
+const totalAlerts = computed(() =>
+  alertPackages.value.reduce((sum, pkg) => sum + pkg.alerts.length, 0),
+)
+
+const isExpanded = shallowRef(false)
+
+const {
+  visibleItems: visiblePackages,
+  hasMore: hasMorePackages,
+  expand: expandPackages,
+} = useVisibleItems(alertPackages, 5)
+
+const alertTypeLabels = computed<Record<SupplyChainAlertType, string>>(() => ({
+  malware: $t('package.supply_chain.types.malware'),
+  gptMalware: $t('package.supply_chain.types.gptMalware'),
+  didYouMean: $t('package.supply_chain.types.didYouMean'),
+  gptDidYouMean: $t('package.supply_chain.types.gptDidYouMean'),
+  troll: $t('package.supply_chain.types.troll'),
+  obfuscatedFile: $t('package.supply_chain.types.obfuscatedFile'),
+  manifestConfusion: $t('package.supply_chain.types.manifestConfusion'),
+  installScripts: $t('package.supply_chain.types.installScripts'),
+  telemetry: $t('package.supply_chain.types.telemetry'),
+  unstableOwnership: $t('package.supply_chain.types.unstableOwnership'),
+}))
+
+const severityLabels = computed<Record<OsvSeverityLevel, string>>(() => ({
+  critical: $t('package.vulnerabilities.severity.critical'),
+  high: $t('package.vulnerabilities.severity.high'),
+  moderate: $t('package.vulnerabilities.severity.moderate'),
+  low: $t('package.vulnerabilities.severity.low'),
+  unknown: $t('package.vulnerabilities.severity.unknown'),
+}))
+
+// A critical alert anywhere in the tree (e.g. malware) makes the whole
+// banner red; otherwise it matches the amber vulnerability banner
+const hasCriticalAlert = computed(() =>
+  alertPackages.value.some(pkg => pkg.alerts.some(alert => alert.severity === 'critical')),
+)
+
+const bannerColor = computed(() =>
+  hasCriticalAlert.value
+    ? 'border-red-600/40 bg-red-500/10 text-red-800 dark:text-red-400'
+    : 'border-amber-600/40 bg-amber-500/10 text-amber-800 dark:text-amber-400',
+)
+
+const depthStyles = {
+  root: 'border-is-2 border-is-amber-600',
+  direct: 'border-is-2 border-is-amber-500',
+  transitive: 'border-is-2 border-is-amber-400',
+} as const
+
+function getDepthStyle(depth: string | undefined) {
+  if (depth && depth in depthStyles) {
+    return depthStyles[depth as keyof typeof depthStyles]
+  }
+  return depthStyles.transitive
+}
+</script>
+
+<template>
+  <section
+    v-if="status === 'success' && alertPackages.length > 0"
+    aria-labelledby="supply-chain-heading"
+    class="relative"
+  >
+    <div role="alert" class="rounded-lg border overflow-hidden" :class="bannerColor">
+      <!-- Header -->
+      <button
+        type="button"
+        class="w-full flex items-center justify-between gap-3 px-4 py-3 text-start transition-colors duration-200 hover:bg-white/5 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-accent/70"
+        :aria-expanded="isExpanded"
+        aria-controls="supply-chain-details"
+        @click="isExpanded = !isExpanded"
+      >
+        <span class="flex items-center gap-2 min-w-0">
+          <span class="i-lucide:shield-alert w-4 h-4 shrink-0" aria-hidden="true" />
+          <span id="supply-chain-heading" class="font-mono text-sm font-medium truncate">
+            {{ $t('package.supply_chain.alerts_found', { alerts: totalAlerts }, totalAlerts) }}
+            {{
+              $t(
+                'package.supply_chain.in_packages',
+                { packages: alertPackages.length },
+                alertPackages.length,
+              )
+            }}
+          </span>
+        </span>
+        <span class="flex items-center gap-2 shrink-0">
+          <!-- all supply-chain alerts are sourced from Socket -->
+          <SecuritySourceLogo source="socket" class="h-5" />
+          <span
+            class="i-lucide:chevron-down w-4 h-4 transition-transform duration-200"
+            :class="{ 'rotate-180': isExpanded }"
+            aria-hidden="true"
+          />
+        </span>
+      </button>
+
+      <!-- Expandable details -->
+      <div
+        v-show="isExpanded"
+        id="supply-chain-details"
+        class="border-t border-border bg-bg-subtle"
+      >
+        <ul class="divide-y divide-border list-none m-0 p-0">
+          <li
+            v-for="pkg in visiblePackages"
+            :key="`${pkg.name}@${pkg.version}`"
+            class="px-4 py-3 bg-amber-500/5"
+            :class="getDepthStyle(pkg.depth)"
+          >
+            <div class="flex items-center justify-between gap-2 mb-2">
+              <div class="flex items-center gap-2 min-w-0 relative">
+                <DependencyPathPopup v-if="pkg.path && pkg.path.length > 1" :path="pkg.path" />
+                <NuxtLink
+                  :to="packageRoute(pkg.name, pkg.version)"
+                  class="font-mono text-sm font-medium hover:underline truncate shrink min-w-0 text-fg"
+                >
+                  {{ pkg.name }}@{{ pkg.version }}
+                </NuxtLink>
+              </div>
+              <a
+                :href="getSocketPackageUrl(pkg.name)"
+                target="_blank"
+                rel="noopener noreferrer"
+                class="shrink-0 inline-flex items-center gap-1 text-xs text-fg-subtle hover:text-fg hover:underline"
+              >
+                {{ $t('common.view_on.socket_dev') }}
+                <span class="i-lucide:external-link w-3 h-3" aria-hidden="true" />
+              </a>
+            </div>
+            <ul class="space-y-1 list-none m-0 p-0">
+              <li
+                v-for="alert in pkg.alerts"
+                :key="alert.type"
+                class="flex items-center gap-2 text-xs text-fg-muted"
+              >
+                <span
+                  class="px-1.5 py-0.5 text-3xs font-mono rounded border shrink-0"
+                  :class="SEVERITY_COLORS[alert.severity]"
+                >
+                  {{ severityLabels[alert.severity] }}
+                </span>
+                <span class="truncate">{{ alertTypeLabels[alert.type] }}</span>
+              </li>
+            </ul>
+          </li>
+        </ul>
+
+        <button
+          v-if="hasMorePackages"
+          type="button"
+          class="w-full px-4 py-2 text-xs font-mono text-fg-muted hover:text-fg border-t border-border transition-colors duration-200"
+          @click="expandPackages"
+        >
+          {{
+            $t('package.supply_chain.show_all_packages', {
+              count: alertPackages.length,
+            })
+          }}
+        </button>
+      </div>
+    </div>
+  </section>
+
+  <!-- Socket enabled but the scan produced no data - subtle, not alarming -->
+  <section
+    v-else-if="status === 'success' && anySourceEnabled && socketScanFailed"
+    :aria-label="$t('package.supply_chain.scan_failed')"
+  >
+    <div class="rounded-lg border border-border bg-bg-subtle px-4 py-3">
+      <div class="flex items-center gap-2">
+        <span class="i-lucide:circle-alert w-4 h-4 text-fg-subtle" aria-hidden="true" />
+        <span class="text-sm text-fg-muted">
+          {{ $t('package.supply_chain.scan_failed') }}
+        </span>
+      </div>
+    </div>
+  </section>
+</template>
diff --git a/app/components/Package/VulnerabilityTree.vue b/app/components/Package/VulnerabilityTree.vue
index bca8eb312d..57ba157efa 100644
--- a/app/components/Package/VulnerabilityTree.vue
+++ b/app/components/Package/VulnerabilityTree.vue
@@ -9,17 +9,36 @@ const { data: vulnTree, status } = useDependencyAnalysis(
   () => props.version,
 )
 
+const { effectiveSources, anySourceEnabled } = useSecuritySources()
+
+const displayTree = computed(() => {
+  if (!vulnTree.value) return null
+  return filterVulnerabilityTreeBySources(vulnTree.value, effectiveSources.value)
+})
+
 const isExpanded = shallowRef(false)
 const showAllVulnerabilities = shallowRef(false)
 
+/** Findings shown per package before "show more" is clicked */
+const VISIBLE_VULNERABILITIES = 2
+
 const {
   visibleItems: visiblePackages,
   hasMore: hasMorePackages,
   expand: expandPackages,
-} = useVisibleItems(() => vulnTree.value?.vulnerablePackages ?? [], 5)
+} = useVisibleItems(() => displayTree.value?.vulnerablePackages ?? [], 5)
 
 const hasVulnerabilities = computed(
-  () => vulnTree.value && vulnTree.value.vulnerablePackages.length > 0,
+  () => displayTree.value && displayTree.value.vulnerablePackages.length > 0,
+)
+
+// A "successful" response where no ENABLED source produced data contains no
+// vulnerability info for this user - treat it like a scan failure rather
+// than a clean result (an 'ok' status on a disabled source must not count)
+const allSourcesFailed = computed(
+  () =>
+    !!vulnTree.value &&
+    noEnabledSecuritySourceHasData(vulnTree.value.sourceStatus, effectiveSources.value),
 )
 
 // Banner - amber for better light mode contrast
@@ -30,15 +49,74 @@ const severityLabels = computed(() => ({
   high: $t('package.vulnerabilities.severity.high'),
   moderate: $t('package.vulnerabilities.severity.moderate'),
   low: $t('package.vulnerabilities.severity.low'),
+  unknown: $t('package.vulnerabilities.severity.unknown'),
+}))
+
+/**
+ * Alias lists on merged entries come from the OSV record (Socket contributes
+ * only its one-to-one cveId pairing), so disputed aliases are attributed to
+ * OSV whenever it is among the entry's sources.
+ */
+function aliasDisputeText(vuln: VulnerabilitySummary): string {
+  const source: SecuritySourceId = vuln.sources.includes('osv') ? 'osv' : 'socket'
+  return $t('package.vulnerabilities.alias_dispute', {
+    source: sourceLabels.value[source],
+    ids: (vuln.disputedAliases ?? []).join(', '),
+  })
+}
+
+/**
+ * Advisory ids to display for a finding: the GHSA and CVE ids, each linking
+ * to its registry. Alias groups (e.g. OSV's) can join distinct advisories,
+ * cross-listing each other's ids - so an aliased id is only shown when it is
+ * unambiguous (a single candidate) or a source explicitly paired it (cveId).
+ * Synthetic ids (SOCKET-*) are internal dedup keys, never shown.
+ */
+function displayIds(vuln: VulnerabilitySummary): Array<{ label: string; url: string }> {
+  const ids: Array<{ label: string; url: string }> = []
+  const ghsaAliases = vuln.aliases.filter(alias => alias.startsWith('GHSA-'))
+  const cveAliases = vuln.aliases.filter(alias => alias.startsWith('CVE-'))
+  const ghsa = vuln.id.startsWith('GHSA-')
+    ? vuln.id
+    : ghsaAliases.length === 1
+      ? ghsaAliases[0]
+      : undefined
+  const cve = vuln.id.startsWith('CVE-')
+    ? vuln.id
+    : (vuln.cveId ?? (cveAliases.length === 1 ? cveAliases[0] : undefined))
+  if (ghsa) ids.push({ label: ghsa, url: `https://github.com/advisories/${ghsa}` })
+  if (cve) ids.push({ label: cve, url: `https://nvd.nist.gov/vuln/detail/${cve}` })
+  if (ids.length === 0 && !vuln.id.startsWith('SOCKET-')) {
+    ids.push({ label: vuln.id, url: vuln.url })
+  }
+  return ids
+}
+
+const sourceLabels = computed<Record<SecuritySourceId, string>>(() => ({
+  osv: $t('settings.security_sources.osv'),
+  socket: $t('settings.security_sources.socket'),
+}))
+
+const reachabilityLabels = computed<Record<VulnerabilityReachability, string>>(() => ({
+  reachable: $t('package.vulnerabilities.reachability.reachable'),
+  maybe_reachable: $t('package.vulnerabilities.reachability.maybe_reachable'),
+  unreachable: $t('package.vulnerabilities.reachability.unreachable'),
 }))
 
+// Reachability is Socket's headline signal: color it by how actionable it is
+const reachabilityColors: Record<VulnerabilityReachability, string> = {
+  reachable: 'text-red-700 dark:text-red-400 border-red-500/40',
+  maybe_reachable: 'text-amber-700 dark:text-amber-400 border-amber-500/40',
+  unreachable: 'text-emerald-700 dark:text-emerald-400 border-emerald-500/40',
+}
+
 function getPackageSeverityLabel(severity: Exclude<OsvSeverityLevel, 'unknown'>) {
   return severityLabels.value[severity]
 }
 
 const summaryText = computed(() => {
-  if (!vulnTree.value) return ''
-  const { totalCounts } = vulnTree.value
+  if (!displayTree.value) return ''
+  const { totalCounts } = displayTree.value
   return SEVERITY_LEVELS.filter(s => totalCounts[s] > 0)
     .map(s => `${totalCounts[s]} ${getPackageSeverityLabel(s)}`)
     .join(', ')
@@ -70,8 +148,13 @@ function getDepthStyle(depth: string | undefined) {
 </script>
 
 <template>
+  <!-- Scary warning: security info would normally appear here, but no source is enabled -->
+  <section v-if="!anySourceEnabled" :aria-label="$t('security_sources.none_enabled')">
+    <SecuritySourcesWarning />
+  </section>
+
   <section
-    v-if="status === 'success' && hasVulnerabilities"
+    v-else-if="status === 'success' && hasVulnerabilities"
     aria-labelledby="vuln-tree-heading"
     class="relative"
   >
@@ -92,11 +175,11 @@ function getDepthStyle(depth: string | undefined) {
               $t(
                 'package.vulnerabilities.tree_found',
                 {
-                  vulns: vulnTree!.totalCounts.total,
-                  packages: vulnTree!.vulnerablePackages.length,
-                  total: vulnTree!.totalPackages,
+                  vulns: displayTree!.totalCounts.total,
+                  packages: displayTree!.vulnerablePackages.length,
+                  total: displayTree!.totalPackages,
                 },
-                vulnTree!.totalCounts.total,
+                displayTree!.totalCounts.total,
               )
             }}
           </span>
@@ -147,19 +230,52 @@ function getDepthStyle(depth: string | undefined) {
             <!-- Show first 2 vulnerabilities -->
             <ul class="space-y-1 list-none m-0 p-0">
               <li
-                v-for="vuln in pkg.vulnerabilities.slice(0, showAllVulnerabilities ? undefined : 2)"
+                v-for="vuln in showAllVulnerabilities
+                  ? pkg.vulnerabilities
+                  : selectPreviewVulnerabilities(pkg.vulnerabilities, VISIBLE_VULNERABILITIES)"
                 :key="vuln.id"
                 class="flex items-center gap-2 text-xs text-fg-muted"
               >
+                <span
+                  class="shrink-0 px-1.5 py-0.5 text-3xs font-mono rounded border"
+                  :class="SEVERITY_COLORS[vuln.severity]"
+                >
+                  {{ severityLabels[vuln.severity] }}
+                </span>
                 <a
-                  :href="vuln.url"
+                  v-for="ref in displayIds(vuln)"
+                  :key="ref.label"
+                  :href="ref.url"
                   target="_blank"
                   rel="noopener noreferrer"
                   class="font-mono hover:underline shrink-0"
                 >
-                  {{ vuln.id }}
+                  {{ ref.label }}
                 </a>
+                <TooltipApp
+                  v-if="vuln.disputedAliases?.length"
+                  :text="aliasDisputeText(vuln)"
+                  class="shrink-0"
+                >
+                  <span
+                    tabindex="0"
+                    class="inline-flex items-center justify-center min-w-5 min-h-5 -m-1 p-1 cursor-help focus-visible:outline-2 focus-visible:outline-accent/70 rounded"
+                  >
+                    <span
+                      class="i-lucide:triangle-alert w-3 h-3 text-amber-600 dark:text-amber-500"
+                      aria-hidden="true"
+                    />
+                    <span class="sr-only">{{ aliasDisputeText(vuln) }}</span>
+                  </span>
+                </TooltipApp>
                 <span class="truncate w-0 flex-1">{{ vuln.summary }}</span>
+                <span
+                  v-if="vuln.reachability"
+                  class="shrink-0 px-1 py-0.5 text-3xs font-mono rounded border"
+                  :class="reachabilityColors[vuln.reachability]"
+                >
+                  {{ reachabilityLabels[vuln.reachability] }}
+                </span>
                 <NuxtLink
                   v-if="vuln.fixedIn"
                   :to="packageRoute(pkg.name, vuln.fixedIn)"
@@ -168,14 +284,42 @@ function getDepthStyle(depth: string | undefined) {
                 >
                   → {{ vuln.fixedIn }}
                 </NuxtLink>
+                <!-- one fixed-width slot per source, so the logos line up in
+                     columns and a missing source reads as an empty slot -->
+                <span class="shrink-0 flex items-center gap-1">
+                  <span class="w-6 flex justify-center">
+                    <span
+                      v-if="vuln.sources.includes('osv')"
+                      class="inline-flex items-center px-1 py-0.5 rounded border border-border"
+                    >
+                      <SecuritySourceLogo source="osv" class="h-3" />
+                    </span>
+                  </span>
+                  <span class="w-6 flex justify-center">
+                    <a
+                      v-if="vuln.sources.includes('socket')"
+                      :href="getSocketPackageUrl(pkg.name)"
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      class="inline-flex items-center px-1 py-0.5 rounded border border-border hover:(border-accent) focus-visible:(border-accent outline-2 outline-accent/70) transition-colors duration-200"
+                      :title="$t('common.view_on.socket_dev')"
+                    >
+                      <SecuritySourceLogo source="socket" class="h-3" />
+                    </a>
+                  </span>
+                </span>
               </li>
               <li
-                v-if="pkg.vulnerabilities.length > 2 && !showAllVulnerabilities"
+                v-if="
+                  pkg.vulnerabilities.length > VISIBLE_VULNERABILITIES && !showAllVulnerabilities
+                "
                 class="text-xs text-fg-subtle"
               >
                 <button type="button" @click="showAllVulnerabilities = true">
                   {{
-                    $t('package.vulnerabilities.more', { count: pkg.vulnerabilities.length - 2 })
+                    $t('package.vulnerabilities.more', {
+                      count: pkg.vulnerabilities.length - VISIBLE_VULNERABILITIES,
+                    })
                   }}
                 </button>
               </li>
@@ -191,14 +335,14 @@ function getDepthStyle(depth: string | undefined) {
         >
           {{
             $t('package.vulnerabilities.show_all_packages', {
-              count: vulnTree!.vulnerablePackages.length,
+              count: displayTree!.vulnerablePackages.length,
             })
           }}
         </button>
 
-        <!-- Warning if some queries failed -->
+        <!-- Warning if some queries failed (OSV-only, so only relevant when OSV is enabled) -->
         <div
-          v-if="vulnTree!.failedQueries"
+          v-if="vulnTree!.failedQueries && effectiveSources.osv"
           class="px-4 py-2 text-xs text-fg-subtle border-t border-border flex items-center gap-2"
         >
           <span class="i-lucide:circle-alert w-3 h-3" aria-hidden="true" />
@@ -213,7 +357,10 @@ function getDepthStyle(depth: string | undefined) {
   <!-- No vulnerabilities found - don't show anything (count is shown in stats banner) -->
 
   <!-- Error state - subtle, not alarming -->
-  <section v-else-if="status === 'error'" aria-labelledby="vuln-tree-error">
+  <section
+    v-else-if="status === 'error' || (status === 'success' && allSourcesFailed)"
+    aria-labelledby="vuln-tree-error"
+  >
     <div class="rounded-lg border border-border bg-bg-subtle px-4 py-3">
       <div class="flex items-center gap-2">
         <span class="i-lucide:circle-alert w-4 h-4 text-fg-subtle" aria-hidden="true" />
diff --git a/app/components/Security/SourceLogo.vue b/app/components/Security/SourceLogo.vue
new file mode 100644
index 0000000000..8f9dcf2ff9
--- /dev/null
+++ b/app/components/Security/SourceLogo.vue
@@ -0,0 +1,47 @@
+<script setup lang="ts">
+import type { SecuritySourceId } from '#shared/types/dependency-analysis'
+import OsvLight from '~/assets/logos/security-sources/osv-mark-light.svg'
+import OsvDark from '~/assets/logos/security-sources/osv-mark-dark.svg'
+import SocketLogo from '~/assets/logos/security-sources/socket.svg'
+
+const props = defineProps<{
+  source: SecuritySourceId
+}>()
+
+// OSV's mark is dark ink + a red dot, so it needs a light-on-dark variant;
+// Socket's brand gradient reads on either theme, so one asset suffices.
+const osv = { light: OsvLight, dark: OsvDark }
+</script>
+
+<template>
+  <img
+    v-if="source === 'socket'"
+    :src="SocketLogo"
+    alt="Socket"
+    title="Socket"
+    class="security-source-logo"
+  />
+  <!-- theme-adaptive pair; only the visible <img> is in the a11y tree, so alt
+       is announced in whichever theme is active. Theme is driven by
+       :root[data-theme] (see app/assets/main.css), with dark as the default -->
+  <span v-else class="security-source-logo inline-flex">
+    <img :src="osv.light" alt="OSV" title="OSV" class="ssl-light h-full w-auto" />
+    <img :src="osv.dark" alt="OSV" title="OSV" class="ssl-dark h-full w-auto" />
+  </span>
+</template>
+
+<style scoped>
+/* dark is the default theme (:root:not([data-theme='light'])) */
+.ssl-light {
+  display: none;
+}
+.ssl-dark {
+  display: inline-block;
+}
+:root[data-theme='light'] .ssl-light {
+  display: inline-block;
+}
+:root[data-theme='light'] .ssl-dark {
+  display: none;
+}
+</style>
diff --git a/app/components/Security/SourcesWarning.vue b/app/components/Security/SourcesWarning.vue
new file mode 100644
index 0000000000..68b4a5434a
--- /dev/null
+++ b/app/components/Security/SourcesWarning.vue
@@ -0,0 +1,33 @@
+<script setup lang="ts">
+withDefaults(
+  defineProps<{
+    /** Hide the "manage in settings" link (e.g. on the settings page itself) */
+    showSettingsLink?: boolean
+  }>(),
+  {
+    showSettingsLink: true,
+  },
+)
+</script>
+
+<template>
+  <div
+    role="alert"
+    class="rounded-lg border border-red-700 dark:border-red-400 bg-red-400/10 px-4 py-3 text-red-700 dark:text-red-400"
+  >
+    <p class="m-0 flex items-center gap-2 font-mono text-sm font-medium">
+      <span class="i-lucide:triangle-alert w-4 h-4 shrink-0" aria-hidden="true" />
+      {{ $t('security_sources.none_enabled') }}
+    </p>
+    <p class="mt-2 mb-0 text-sm">
+      {{ $t('security_sources.none_enabled_detail') }}
+      <NuxtLink
+        v-if="showSettingsLink"
+        to="/settings"
+        class="underline underline-offset-4 decoration-red-600/60 dark:decoration-red-400/50 hover:decoration-fg focus-visible:decoration-fg focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/70 transition-colors"
+      >
+        {{ $t('security_sources.manage_in_settings') }}
+      </NuxtLink>
+    </p>
+  </div>
+</template>
diff --git a/app/components/SecuritySourceToggle.client.vue b/app/components/SecuritySourceToggle.client.vue
new file mode 100644
index 0000000000..3b55d9dc1a
--- /dev/null
+++ b/app/components/SecuritySourceToggle.client.vue
@@ -0,0 +1,136 @@
+<script setup lang="ts">
+import type { SecuritySourceId } from '#shared/types/dependency-analysis'
+
+const props = withDefaults(
+  defineProps<{
+    /** Smaller trigger button, for dense contexts like the stats banner */
+    compact?: boolean
+  }>(),
+  {
+    compact: false,
+  },
+)
+
+const { t } = useI18n()
+const { enabledSources, sourceAvailability, anySourceEnabled, setSourceEnabled } =
+  useSecuritySources()
+
+const isOpen = shallowRef(false)
+const toggleRef = useTemplateRef('toggleRef')
+
+onClickOutside(toggleRef, () => {
+  isOpen.value = false
+})
+
+useEventListener('keydown', event => {
+  if (event.key === 'Escape' && isOpen.value) {
+    isOpen.value = false
+  }
+})
+
+const sourceLabels = computed<Record<SecuritySourceId, { label: string; description: string }>>(
+  () => ({
+    osv: {
+      label: t('settings.security_sources.osv'),
+      description: t('settings.security_sources.osv_description'),
+    },
+    socket: {
+      label: t('settings.security_sources.socket'),
+      description: t('settings.security_sources.socket_description'),
+    },
+  }),
+)
+
+const sources = computed(() =>
+  SECURITY_SOURCE_IDS.map(id => ({
+    id,
+    label: sourceLabels.value[id].label,
+    description: sourceLabels.value[id].description,
+    enabled: enabledSources.value[id],
+    available: sourceAvailability.value[id],
+  })),
+)
+</script>
+
+<template>
+  <div ref="toggleRef" class="relative">
+    <ButtonBase
+      :aria-label="$t('settings.security_sources.label')"
+      :aria-expanded="isOpen"
+      aria-haspopup="true"
+      size="sm"
+      class="border-none justify-center !px-0"
+      :class="props.compact ? 'w-6 h-6' : 'w-8 h-8'"
+      classicon="i-lucide:shield"
+      @click="isOpen = !isOpen"
+    />
+
+    <Transition
+      enter-active-class="transition-all duration-150"
+      leave-active-class="transition-all duration-100"
+      enter-from-class="opacity-0 translate-y-1"
+      leave-to-class="opacity-0 translate-y-1"
+    >
+      <div
+        v-if="isOpen"
+        class="absolute inset-ie-0 top-full pt-2 w-72 z-50 normal-case tracking-normal"
+        role="menu"
+        :aria-label="$t('settings.security_sources.label')"
+      >
+        <div
+          class="bg-bg-subtle/80 backdrop-blur-sm border border-border-subtle rounded-lg shadow-lg shadow-bg-elevated/50 overflow-hidden p-1"
+        >
+          <button
+            v-for="source in sources"
+            :key="source.id"
+            type="button"
+            role="menuitemcheckbox"
+            :aria-checked="source.enabled && source.available"
+            :disabled="!source.available"
+            class="w-full flex items-start gap-3 px-3 py-2.5 rounded-md text-start transition-colors"
+            :class="[
+              source.available
+                ? 'cursor-pointer hover:bg-bg-muted'
+                : 'cursor-not-allowed opacity-60',
+              source.enabled && source.available ? 'bg-bg-muted' : '',
+            ]"
+            @click="setSourceEnabled(source.id, !source.enabled)"
+          >
+            <span
+              class="w-4 h-4 mt-0.5 shrink-0"
+              :class="[
+                source.enabled && source.available
+                  ? 'i-lucide:square-check text-accent'
+                  : 'i-lucide:square text-fg-muted',
+              ]"
+              aria-hidden="true"
+            />
+            <div class="min-w-0 flex-1">
+              <div
+                class="text-sm font-medium"
+                :class="source.enabled && source.available ? 'text-fg' : 'text-fg-muted'"
+              >
+                {{ source.label }}
+              </div>
+              <p class="text-xs text-fg-subtle mt-0.5">
+                {{ source.description }}
+              </p>
+              <p v-if="!source.available" class="text-xs text-fg-subtle mt-0.5 italic">
+                {{ $t('settings.security_sources.unavailable_on_deployment') }}
+              </p>
+            </div>
+          </button>
+
+          <!-- Warning when every source is disabled -->
+          <div
+            v-if="!anySourceEnabled"
+            class="border-t border-border mx-1 mt-1 pt-2 pb-1 px-2 flex items-start gap-2 text-xs text-red-700 dark:text-red-400"
+          >
+            <span class="i-lucide:triangle-alert w-3.5 h-3.5 mt-0.5 shrink-0" aria-hidden="true" />
+            <span>{{ $t('security_sources.none_enabled') }}</span>
+          </div>
+        </div>
+      </div>
+    </Transition>
+  </div>
+</template>
diff --git a/app/components/SecuritySourceToggle.server.vue b/app/components/SecuritySourceToggle.server.vue
new file mode 100644
index 0000000000..0409821548
--- /dev/null
+++ b/app/components/SecuritySourceToggle.server.vue
@@ -0,0 +1,22 @@
+<script setup lang="ts">
+withDefaults(
+  defineProps<{
+    /** Smaller trigger button, for dense contexts like the stats banner */
+    compact?: boolean
+  }>(),
+  {
+    compact: false,
+  },
+)
+</script>
+
+<template>
+  <div class="relative">
+    <div
+      class="flex items-center justify-center rounded-md text-fg-subtle"
+      :class="compact ? 'w-6 h-6' : 'w-8 h-8'"
+    >
+      <span class="i-lucide:shield w-4 h-4" aria-hidden="true" />
+    </div>
+  </div>
+</template>
diff --git a/app/components/Settings/Switch.vue b/app/components/Settings/Switch.vue
new file mode 100644
index 0000000000..45c45c7775
--- /dev/null
+++ b/app/components/Settings/Switch.vue
@@ -0,0 +1,64 @@
+<script setup lang="ts">
+const props = withDefaults(
+  defineProps<{
+    id?: string
+    disabled?: boolean
+    ariaLabel?: string
+  }>(),
+  {
+    disabled: false,
+  },
+)
+
+const checked = defineModel<boolean>({
+  required: true,
+})
+</script>
+
+<template>
+  <input
+    role="switch"
+    type="checkbox"
+    :id="props.id"
+    :disabled="props.disabled"
+    :aria-label="props.ariaLabel"
+    v-model="checked"
+    class="toggle appearance-none h-6 w-11 rounded-full border border-fg relative shrink-0 bg-fg/50 transition-colors duration-200 ease-in-out checked:bg-fg [@media(hover:hover)]:hover:bg-fg/60 [@media(hover:hover)]:checked:hover:(bg-fg/80 after:opacity-50) focus-visible:(outline-2 outline-accent outline-offset-2) before:(content-[''] absolute h-5 w-5 top-px start-px rounded-full bg-bg transition-transform duration-200 ease-in-out) checked:before:translate-x-[20px] rtl:checked:before:-translate-x-[20px] after:(content-[''] absolute h-3.5 w-3.5 top-[4px] start-[4px] i-lucide:check bg-fg opacity-0 transition-all duration-200 ease-in-out) checked:after:opacity-100 checked:after:translate-x-[20px] rtl:checked:after:-translate-x-[20px]"
+  />
+</template>
+
+<style scoped>
+/* Support forced colors */
+@media (forced-colors: active) {
+  .toggle {
+    background: Canvas;
+    border-color: CanvasText;
+  }
+
+  .toggle:checked {
+    background: Highlight;
+    border-color: CanvasText;
+  }
+
+  .toggle::before {
+    background-color: CanvasText;
+  }
+
+  .toggle:checked::before {
+    background-color: Canvas;
+  }
+
+  .toggle::after {
+    background-color: Highlight;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .toggle,
+  .toggle::before,
+  .toggle::after {
+    transition: none !important;
+    animation: none !important;
+  }
+}
+</style>
diff --git a/app/components/Settings/Toggle.client.vue b/app/components/Settings/Toggle.client.vue
index 29b07f6b62..d69caf6c97 100644
--- a/app/components/Settings/Toggle.client.vue
+++ b/app/components/Settings/Toggle.client.vue
@@ -11,10 +11,12 @@ const props = withDefaults(
     tooltipTo?: string
     tooltipOffset?: number
     reverseOrder?: boolean
+    disabled?: boolean
   }>(),
   {
     justify: 'between',
     reverseOrder: false,
+    disabled: false,
   },
 )
 
@@ -27,8 +29,11 @@ const id = useId()
 <template>
   <label
     :for="id"
-    class="grid items-center gap-1.5 py-1 -my-1 grid-cols-[auto_1fr_auto] cursor-pointer"
-    :class="[justify === 'start' ? 'justify-start' : '']"
+    class="grid items-center gap-1.5 py-1 -my-1 grid-cols-[auto_1fr_auto]"
+    :class="[
+      justify === 'start' ? 'justify-start' : '',
+      props.disabled ? 'cursor-not-allowed opacity-60' : 'cursor-pointer',
+    ]"
     :style="
       props.reverseOrder
         ? 'grid-template-areas: \'toggle . label-text\''
@@ -53,12 +58,10 @@ const id = useId()
     >
       {{ label }}
     </span>
-    <input
-      role="switch"
-      type="checkbox"
+    <SettingsSwitch
       :id="id"
+      :disabled="props.disabled"
       v-model="checked"
-      class="toggle appearance-none h-6 w-11 rounded-full border border-fg relative shrink-0 bg-fg/50 transition-colors duration-200 ease-in-out checked:bg-fg [@media(hover:hover)]:hover:bg-fg/60 [@media(hover:hover)]:checked:hover:(bg-fg/80 after:opacity-50) focus-visible:(outline-2 outline-accent outline-offset-2) before:(content-[''] absolute h-5 w-5 top-px start-px rounded-full bg-bg transition-transform duration-200 ease-in-out) checked:before:translate-x-[20px] rtl:checked:before:-translate-x-[20px] after:(content-[''] absolute h-3.5 w-3.5 top-[4px] start-[4px] i-lucide:check bg-fg opacity-0 transition-all duration-200 ease-in-out) checked:after:opacity-100 checked:after:translate-x-[20px] rtl:checked:after:-translate-x-[20px]"
       style="grid-area: toggle; justify-self: end"
     />
   </label>
@@ -66,39 +69,3 @@ const id = useId()
     {{ description }}
   </p>
 </template>
-
-<style scoped>
-/* Support forced colors */
-@media (forced-colors: active) {
-  .toggle {
-    background: Canvas;
-    border-color: CanvasText;
-  }
-
-  .toggle:checked {
-    background: Highlight;
-    border-color: CanvasText;
-  }
-
-  .toggle::before {
-    background-color: CanvasText;
-  }
-
-  .toggle:checked::before {
-    background-color: Canvas;
-  }
-
-  .toggle::after {
-    background-color: Highlight;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .toggle,
-  .toggle::before,
-  .toggle::after {
-    transition: none !important;
-    animation: none !important;
-  }
-}
-</style>
diff --git a/app/composables/useFacetSelection.ts b/app/composables/useFacetSelection.ts
index 18b8b9b7f7..c1f267e97d 100644
--- a/app/composables/useFacetSelection.ts
+++ b/app/composables/useFacetSelection.ts
@@ -90,6 +90,13 @@ export function useFacetSelection(queryParam = 'facets') {
         chartable_scatter: true,
         formatter: v => compactNumberFormatter.value.format(v),
       },
+      supplyChainAlerts: {
+        label: t(`compare.facets.items.supplyChainAlerts.label`),
+        description: t(`compare.facets.items.supplyChainAlerts.description`),
+        chartable: false,
+        chartable_scatter: true,
+        formatter: v => compactNumberFormatter.value.format(v),
+      },
       lastUpdated: {
         label: t(`compare.facets.items.lastUpdated.label`),
         description: t(`compare.facets.items.lastUpdated.description`),
diff --git a/app/composables/usePackageComparison.ts b/app/composables/usePackageComparison.ts
index 3e47b0028e..544dac75c4 100644
--- a/app/composables/usePackageComparison.ts
+++ b/app/composables/usePackageComparison.ts
@@ -37,6 +37,8 @@ export interface PackageComparisonData {
     count: number
     severity: { critical: number; high: number; moderate: number; low: number }
   }
+  /** Total Socket supply-chain alerts across the tree (undefined = unknown) */
+  supplyChainAlerts?: number
   metadata?: {
     license?: string
     /**
@@ -62,6 +64,16 @@ export interface PackageComparisonData {
   isNoDependency?: boolean
 }
 
+/**
+ * Internal cache entry: the raw dependency-analysis result is kept alongside
+ * the public data so vulnerability counts can be re-derived at render time,
+ * filtered by the user's enabled security sources. It is stripped from the
+ * exposed `packagesData`.
+ */
+interface CachedPackageData extends PackageComparisonData {
+  vulnerabilityTree?: VulnerabilityTreeResult
+}
+
 /**
  * Resolve a requested version (exact version or dist-tag) against a packument.
  *
@@ -88,13 +100,56 @@ export function usePackageComparison(packageNames: MaybeRefOrGetter<string[]>) {
   const numberFormatter = useNumberFormatter()
   const compactNumberFormatter = useCompactNumberFormatter()
   const bytesFormatter = useBytesFormatter()
+  const { anySourceEnabled: anySecuritySourceEnabled, effectiveSources: effectiveSecuritySources } =
+    useSecuritySources()
   const packages = computed(() => toValue(packageNames))
 
   // Cache of fetched data by package name (source of truth)
-  const cache = shallowRef(new Map<string, PackageComparisonData>())
+  const cache = shallowRef(new Map<string, CachedPackageData>())
+
+  // Derive display counts from the raw tree, filtered by the user's enabled
+  // security sources. Undefined ("unknown") when the fetch failed, no source
+  // is enabled, or no enabled source produced data - never a misleading zero.
+  function deriveVulnerabilities(
+    tree: VulnerabilityTreeResult | undefined,
+  ): PackageComparisonData['vulnerabilities'] {
+    if (!tree || !anySecuritySourceEnabled.value) return undefined
+    if (noEnabledSecuritySourceHasData(tree.sourceStatus, effectiveSecuritySources.value)) {
+      return undefined
+    }
+    const { total, ...severity } = filterVulnerabilityTreeBySources(
+      tree,
+      effectiveSecuritySources.value,
+    ).totalCounts
+    return { count: total, severity }
+  }
+
+  function deriveSupplyChainAlerts(tree: VulnerabilityTreeResult | undefined): number | undefined {
+    // supply-chain alerts come only from Socket, so a 0 is only meaningful
+    // when Socket actually scanned - otherwise it's "unknown", never a zero
+    if (!tree || !effectiveSecuritySources.value.socket) return undefined
+    if (!securitySourceHasData(tree.sourceStatus, 'socket')) return undefined
+    return filterVulnerabilityTreeBySources(
+      tree,
+      effectiveSecuritySources.value,
+    ).supplyChainPackages.reduce((sum, pkg) => sum + pkg.alerts.length, 0)
+  }
 
-  // Derived array in current package order
-  const packagesData = computed(() => packages.value.map(name => cache.value.get(name) ?? null))
+  // Derived array in current package order. The raw tree stays internal to
+  // the cache; consumers only see the derived (source-filtered) counts.
+  const packagesData = computed<(PackageComparisonData | null)[]>(() =>
+    packages.value.map(name => {
+      const data = cache.value.get(name)
+      if (!data) return null
+      const { vulnerabilityTree, ...rest } = data
+      if (data.isNoDependency) return rest
+      return {
+        ...rest,
+        vulnerabilities: deriveVulnerabilities(vulnerabilityTree),
+        supplyChainAlerts: deriveSupplyChainAlerts(vulnerabilityTree),
+      }
+    }),
+  )
 
   const status = shallowRef<'idle' | 'pending' | 'success' | 'error'>('idle')
   const error = shallowRef<Error | null>(null)
@@ -136,7 +191,7 @@ export function usePackageComparison(packageNames: MaybeRefOrGetter<string[]>) {
     try {
       // First pass: fetch fast data (package info, downloads, analysis, vulns)
       const results = await Promise.all(
-        namesToFetch.map(async (spec): Promise<PackageComparisonData | null> => {
+        namesToFetch.map(async (spec): Promise<CachedPackageData | null> => {
           try {
             // A spec may include a version (vue@3.6.0)
             const { name, version: requestedVersion } = parsePackageSpec(spec)
@@ -194,16 +249,6 @@ export function usePackageComparison(packageNames: MaybeRefOrGetter<string[]>) {
               exports: versionData?.exports,
             })
 
-            // Vulnerabilities
-            let vulnsTotal: number = 0
-            let vulnsSeverity = { critical: 0, high: 0, moderate: 0, low: 0 }
-
-            if (vulns) {
-              const { total, ...severity } = vulns.totalCounts
-              vulnsTotal = total
-              vulnsSeverity = severity
-            }
-
             return {
               package: {
                 name: pkgData.name,
@@ -215,10 +260,7 @@ export function usePackageComparison(packageNames: MaybeRefOrGetter<string[]>) {
               directDeps: versionData ? getDependencyCount(versionData) : null,
               installSize: undefined, // Will be filled in second pass
               analysis: analysis ?? undefined,
-              vulnerabilities: {
-                count: vulnsTotal,
-                severity: vulnsSeverity,
-              },
+              vulnerabilityTree: vulns ?? undefined,
               metadata: {
                 license: normalizeLicense(pkgData.license),
                 // Use version-specific publish time, NOT time.modified (which can be
@@ -310,6 +352,21 @@ export function usePackageComparison(packageNames: MaybeRefOrGetter<string[]>) {
     return packagesData.value.map(pkg => {
       if (!pkg) return null
 
+      // Security data has no meaning when no source is enabled - show an
+      // explicit "unavailable" cell instead of real (or zero) counts
+      if (
+        (facet === 'vulnerabilities' || facet === 'supplyChainAlerts') &&
+        !anySecuritySourceEnabled.value &&
+        !pkg.isNoDependency
+      ) {
+        return {
+          raw: null,
+          display: '—',
+          status: 'muted',
+          tooltip: t('security_sources.none_enabled'),
+        }
+      }
+
       return computeFacetValue(
         facet,
         pkg,
@@ -537,6 +594,23 @@ function computeFacetValue(
         status: count === 0 ? 'good' : sev.critical > 0 || sev.high > 0 ? 'bad' : 'warning',
       }
     }
+    case 'supplyChainAlerts': {
+      if (data.supplyChainAlerts === undefined) {
+        if (isNoDependency)
+          return {
+            raw: 'up-to-you',
+            display: t('compare.facets.values.up_to_you'),
+            status: 'good',
+          }
+        return null
+      }
+      const count = data.supplyChainAlerts
+      return {
+        raw: count,
+        display: count === 0 ? t('compare.facets.values.none') : formatNumber(count),
+        status: count === 0 ? 'good' : 'warning',
+      }
+    }
     case 'lastUpdated': {
       const lastUpdated = data.metadata?.lastUpdated
       const resolved = lastUpdated ? resolveNoDependencyDisplay(lastUpdated, t) : null
diff --git a/app/composables/useSettings.ts b/app/composables/useSettings.ts
index bfa860708d..1e43520ee7 100644
--- a/app/composables/useSettings.ts
+++ b/app/composables/useSettings.ts
@@ -1,5 +1,6 @@
 import type { RemovableRef } from '@vueuse/core'
 import type { LocaleObject } from '@nuxtjs/i18n'
+import type { SecuritySourceId } from '#shared/types/dependency-analysis'
 import { useLocalStorage, useMounted } from '@vueuse/core'
 import { ACCENT_COLORS, type AccentColorId } from '#shared/utils/constants'
 import { BACKGROUND_THEMES, FOREGROUND_THEMES } from '#shared/utils/constants'
@@ -32,6 +33,8 @@ export interface AppSettings {
   selectedLocale: LocaleObject['code'] | null
   /** Search provider for package search */
   searchProvider: SearchProvider
+  /** Enabled security data sources for vulnerability/security display */
+  securitySources: Record<SecuritySourceId, boolean>
   /** Show search results as you type */
   instantSearch: boolean
   /** Enable/disable keyboard shortcuts */
@@ -72,6 +75,10 @@ const DEFAULT_SETTINGS: AppSettings = {
   preferredBackgroundTheme: null,
   preferredForegroundTheme: null,
   searchProvider: import.meta.test ? 'npm' : 'algolia',
+  securitySources: {
+    osv: true,
+    socket: true,
+  },
   instantSearch: true,
   keyboardShortcuts: true,
   changelogAutoScroll: true,
@@ -98,6 +105,17 @@ const DEFAULT_SETTINGS: AppSettings = {
 
 const STORAGE_KEY = 'npmx-settings'
 
+/**
+ * Stable pre-mount value for useSecuritySources(): before hydration the
+ * useMounted() guard returns this instead of the stored settings, so the
+ * first client render matches the server render. Frozen so this shared
+ * fallback can't be mutated by a consumer.
+ */
+const DEFAULT_SECURITY_SOURCES: Readonly<Record<SecuritySourceId, boolean>> = Object.freeze({
+  osv: true,
+  socket: true,
+})
+
 // Shared settings instance (singleton per app)
 let settingsRef: RemovableRef<AppSettings> | null = null
 
@@ -107,7 +125,10 @@ let settingsRef: RemovableRef<AppSettings> | null = null
  */
 export function useSettings() {
   if (!settingsRef) {
-    settingsRef = useLocalStorage<AppSettings>(STORAGE_KEY, DEFAULT_SETTINGS, {
+    // clone so a fresh visitor's settings (and, via mergeDefaults' shallow
+    // merge, any nested default it aliases) can be mutated without corrupting
+    // the module-level DEFAULT_SETTINGS
+    settingsRef = useLocalStorage<AppSettings>(STORAGE_KEY, structuredClone(DEFAULT_SETTINGS), {
       mergeDefaults: true,
     })
   }
@@ -231,6 +252,59 @@ export function useSearchProvider() {
   }
 }
 
+/**
+ * Composable for managing enabled security data sources (OSV, ...).
+ *
+ * `enabledSources` reflects the user's stored preference. `effectiveSources`
+ * additionally accounts for sources that are unavailable on this deployment
+ * (a checked-but-unavailable source is treated as off without mutating the
+ * stored preference). All security UI should key off the effective values.
+ */
+export function useSecuritySources() {
+  const { settings } = useSettings()
+  const isMounted = useMounted()
+  const runtimeConfig = useRuntimeConfig()
+
+  const enabledSources = computed<Record<SecuritySourceId, boolean>>(() =>
+    isMounted.value ? settings.value.securitySources : DEFAULT_SECURITY_SOURCES,
+  )
+
+  // Whether each source can deliver data on this deployment. Socket requires
+  // a server-side API key; without one the checkbox renders as unavailable.
+  const sourceAvailability = computed<Record<SecuritySourceId, boolean>>(() => ({
+    osv: true,
+    socket: !!runtimeConfig.public.socketConfigured,
+  }))
+
+  const effectiveSources = computed<Record<SecuritySourceId, boolean>>(() => {
+    const result = {} as Record<SecuritySourceId, boolean>
+    for (const source of SECURITY_SOURCE_IDS) {
+      // a source newly added to SECURITY_SOURCE_IDS is absent from an existing
+      // visitor's persisted (shallow-merged) settings, so fall back to its default
+      result[source] =
+        (enabledSources.value[source] ?? DEFAULT_SECURITY_SOURCES[source]) &&
+        sourceAvailability.value[source]
+    }
+    return result
+  })
+
+  const anySourceEnabled = computed(() =>
+    Object.values(effectiveSources.value).some(enabled => enabled),
+  )
+
+  function setSourceEnabled(source: SecuritySourceId, enabled: boolean) {
+    settings.value.securitySources[source] = enabled
+  }
+
+  return {
+    enabledSources,
+    sourceAvailability,
+    effectiveSources,
+    anySourceEnabled,
+    setSourceEnabled,
+  }
+}
+
 export function useBackgroundTheme() {
   const { t } = useI18n()
 
diff --git a/app/pages/package/[[org]]/[name].vue b/app/pages/package/[[org]]/[name].vue
index 28615fb30f..ebd64d41c3 100644
--- a/app/pages/package/[[org]]/[name].vue
+++ b/app/pages/package/[[org]]/[name].vue
@@ -382,9 +382,38 @@ const hasDependencies = computed(() => {
   )
 })
 
-// Vulnerability count for the stats banner
-const vulnCount = computed(() => vulnTree.value?.totalCounts.total ?? 0)
+// Vulnerability count for the stats banner, filtered to enabled security sources
+const { anySourceEnabled: anySecuritySourceEnabled, effectiveSources: effectiveSecuritySources } =
+  useSecuritySources()
+const displaySecurityTree = computed(() =>
+  vulnTree.value
+    ? filterVulnerabilityTreeBySources(vulnTree.value, effectiveSecuritySources.value)
+    : null,
+)
+const vulnCount = computed(() => displaySecurityTree.value?.totalCounts.total ?? 0)
 const hasVulnerabilities = computed(() => vulnCount.value > 0)
+// Supply-chain alerts are a distinct signal (Socket only) shown alongside vulns
+const supplyChainCount = computed(() =>
+  (displaySecurityTree.value?.supplyChainPackages ?? []).reduce(
+    (sum, entry) => sum + entry.alerts.length,
+    0,
+  ),
+)
+// A "0" is only meaningful when Socket actually scanned; otherwise the count
+// is structurally always 0 and must not read as a clean result
+const supplyChainScanned = computed(
+  () =>
+    !!vulnTree.value &&
+    effectiveSecuritySources.value.socket &&
+    securitySourceHasData(vulnTree.value.sourceStatus, 'socket'),
+)
+// A scan where no ENABLED security source produced data carries no
+// information for this user - show "-" instead of a reassuring zero
+const vulnScanFailed = computed(
+  () =>
+    !!vulnTree.value &&
+    noEnabledSecuritySourceHasData(vulnTree.value.sourceStatus, effectiveSecuritySources.value),
+)
 
 // Total transitive dependencies count (from either vuln tree or install size)
 // Subtract 1 to exclude the root package itself
@@ -582,7 +611,7 @@ const showSkeleton = shallowRef(false)
 
           <!-- Stats grid -->
           <dl
-            class="grid grid-cols-2 sm:grid-cols-7 md:grid-cols-11 gap-3 sm:gap-4 py-4 sm:py-6 mt-4 sm:mt-6 border-t border-b border-border"
+            class="grid grid-cols-2 sm:grid-cols-7 md:grid-cols-13 gap-3 sm:gap-4 py-4 sm:py-6 mt-4 sm:mt-6 border-t border-b border-border"
           >
             <div class="space-y-1 sm:col-span-2">
               <dt class="text-xs text-fg-subtle uppercase tracking-wider">
@@ -694,17 +723,27 @@ const showSkeleton = shallowRef(false)
 
             <!-- Vulnerabilities count -->
             <div class="space-y-1 sm:col-span-2">
-              <dt class="text-xs text-fg-subtle uppercase tracking-wider">
+              <dt class="text-xs text-fg-subtle uppercase tracking-wider flex items-center gap-1">
                 {{ $t('package.stats.vulns') }}
+                <SecuritySourceToggle compact class="-my-1" />
               </dt>
               <dd class="font-mono text-sm text-fg">
                 <span
-                  v-if="vulnTreeStatus === 'pending' || vulnTreeStatus === 'idle'"
+                  v-if="!anySecuritySourceEnabled"
+                  class="inline-flex items-center gap-1 text-red-700 dark:text-red-400"
+                  :title="$t('security_sources.none_enabled')"
+                >
+                  <span class="i-lucide:triangle-alert w-3 h-3" aria-hidden="true" />
+                  <span aria-hidden="true">&mdash;</span>
+                  <span class="sr-only">{{ $t('security_sources.none_enabled') }}</span>
+                </span>
+                <span
+                  v-else-if="vulnTreeStatus === 'pending' || vulnTreeStatus === 'idle'"
                   class="inline-flex items-center gap-1 text-fg-subtle"
                 >
                   <span class="i-svg-spinners:ring-resize w-3 h-3" aria-hidden="true" />
                 </span>
-                <span v-else-if="vulnTreeStatus === 'success'">
+                <span v-else-if="vulnTreeStatus === 'success' && !vulnScanFailed">
                   <span v-if="hasVulnerabilities" class="text-amber-700 dark:text-amber-500">
                     {{ numberFormatter.format(vulnCount) }}
                   </span>
@@ -717,6 +756,42 @@ const showSkeleton = shallowRef(false)
               </dd>
             </div>
 
+            <!-- Supply chain alerts count (Socket) -->
+            <div class="space-y-1 sm:col-span-2">
+              <dt class="text-xs text-fg-subtle uppercase tracking-wider">
+                {{ $t('package.stats.supply_chain') }}
+              </dt>
+              <dd class="font-mono text-sm text-fg">
+                <span
+                  v-if="!anySecuritySourceEnabled"
+                  class="inline-flex items-center gap-1 text-red-700 dark:text-red-400"
+                  :title="$t('security_sources.none_enabled')"
+                >
+                  <span class="i-lucide:triangle-alert w-3 h-3" aria-hidden="true" />
+                  <span aria-hidden="true">&mdash;</span>
+                  <span class="sr-only">{{ $t('security_sources.none_enabled') }}</span>
+                </span>
+                <span
+                  v-else-if="vulnTreeStatus === 'pending' || vulnTreeStatus === 'idle'"
+                  class="inline-flex items-center gap-1 text-fg-subtle"
+                >
+                  <span class="i-svg-spinners:ring-resize w-3 h-3" aria-hidden="true" />
+                </span>
+                <span v-else-if="vulnTreeStatus === 'success' && supplyChainScanned">
+                  <span v-if="supplyChainCount > 0" class="text-amber-700 dark:text-amber-500">
+                    {{ numberFormatter.format(supplyChainCount) }}
+                  </span>
+                  <span v-else class="inline-flex items-center gap-1 text-fg-muted">
+                    <span class="i-lucide:check w-3 h-3" aria-hidden="true" />
+                    {{ numberFormatter.format(0) }}
+                  </span>
+                </span>
+                <span v-else class="text-fg-subtle" :title="$t('package.supply_chain.not_scanned')">
+                  -
+                </span>
+              </dd>
+            </div>
+
             <div
               v-if="resolvedVersion && pkg.time?.[resolvedVersion]"
               class="space-y-1 sm:col-span-2"
@@ -909,6 +984,12 @@ const showSkeleton = shallowRef(false)
               :package-name="pkg.name"
               :version="resolvedVersion"
             />
+            <PackageSupplyChainAlerts
+              v-if="resolvedVersion"
+              :package-name="pkg.name"
+              :version="resolvedVersion"
+              class="mt-3"
+            />
             <PackageDeprecatedTree
               v-if="resolvedVersion"
               :package-name="pkg.name"
diff --git a/app/pages/search.vue b/app/pages/search.vue
index 9010734a57..f11499c00f 100644
--- a/app/pages/search.vue
+++ b/app/pages/search.vue
@@ -704,7 +704,10 @@ onBeforeUnmount(() => {
           <span class="i-lucide:arrow-left rtl-flip w-4 h-4" aria-hidden="true" />
           <span class="hidden sm:inline">{{ $t('nav.back') }}</span>
         </button>
-        <SearchProviderToggle v-else />
+        <div v-else class="flex items-center gap-1">
+          <SecuritySourceToggle />
+          <SearchProviderToggle />
+        </div>
       </div>
 
       <PackageSelectionView
diff --git a/app/pages/settings.stories.ts b/app/pages/settings.stories.ts
index 6399a391fa..a422b8ef55 100644
--- a/app/pages/settings.stories.ts
+++ b/app/pages/settings.stories.ts
@@ -35,6 +35,41 @@ export const NpmRegistryDataSource: Story = {
   },
 }
 
+/** Without a server-side API key, the Socket source renders disabled with an "unavailable on this deployment" note. */
+export const SocketSourceUnavailable: Story = {
+  play: async ({ canvas, step }) => {
+    await step('The Socket toggle is disabled without a configured key', async () => {
+      const toggle = await canvas.findByRole('switch', { name: /socket/i })
+      await expect(toggle).toBeDisabled()
+      await expect(await canvas.findByText(/unavailable on this deployment/i)).toBeVisible()
+    })
+  },
+}
+
+/** Disabling every security data source surfaces the "no security data source is enabled" warning. */
+export const NoSecuritySourcesWarning: Story = {
+  play: async ({ canvas, step }) => {
+    await step('Disable the OSV security data source', async () => {
+      const toggle = await canvas.findByRole('switch', { name: /osv/i })
+      await expect(toggle).toBeChecked()
+      await userEvent.click(toggle)
+      await expect(toggle).not.toBeChecked()
+    })
+
+    await step('The no-sources warning appears', async () => {
+      const warning = await canvas.findByRole('alert')
+      await expect(warning).toHaveTextContent(/no security data source is enabled/i)
+    })
+
+    await step('Re-enabling a source dismisses the warning', async () => {
+      const toggle = await canvas.findByRole('switch', { name: /osv/i })
+      await userEvent.click(toggle)
+      await expect(toggle).toBeChecked()
+      await expect(canvas.queryByRole('alert')).not.toBeInTheDocument()
+    })
+  },
+}
+
 /** Non-English locale with incomplete translations. The Language section shows `SettingsTranslationHelper` with a progress bar and list of missing translation keys. `/lunaria/status.json` is intercepted by MSW to provide mock translation status data. */
 export const NonEnglishTranslationHelper: Story = {
   globals: {
diff --git a/app/pages/settings.vue b/app/pages/settings.vue
index bd05b2c393..7f77909f2f 100644
--- a/app/pages/settings.vue
+++ b/app/pages/settings.vue
@@ -8,6 +8,19 @@ const colorMode = useColorMode()
 const { currentLocaleStatus, isSourceLocale } = useI18nStatus()
 const keyboardShortcutsEnabled = useKeyboardShortcuts()
 const { toggleCodeLigatures } = useCodeLigatures()
+const { anySourceEnabled, sourceAvailability, effectiveSources } = useSecuritySources()
+const osvSwitchId = useId()
+const socketSwitchId = useId()
+
+// When Socket is unavailable on this deployment the toggle is disabled and
+// reads as off (matching the header popover), without ever mutating the
+// stored preference; when available it round-trips the stored value.
+const socketEnabled = computed({
+  get: () => effectiveSources.value.socket,
+  set: value => {
+    settings.value.securitySources.socket = value
+  },
+})
 
 // Create a computed property to handle locale binding properly
 const localeCodes = computed<LocaleObject['code'][]>(() =>
@@ -255,6 +268,103 @@ useSeoMeta({
           </div>
         </section>
 
+        <!-- SECURITY Section -->
+        <section>
+          <h2 class="text-xs text-fg-muted uppercase tracking-wider mb-4">
+            {{ $t('settings.sections.security') }}
+          </h2>
+          <div class="bg-bg-subtle border border-border rounded-lg p-4 sm:p-6">
+            <div class="space-y-2">
+              <span class="block text-sm text-fg font-medium">
+                {{ $t('settings.security_sources.label') }}
+              </span>
+              <p class="text-xs text-fg-muted mb-3">
+                {{ $t('settings.security_sources.description') }}
+              </p>
+            </div>
+
+            <!-- One shared grid so logo / label / switch / description line up
+                 across every source. ClientOnly keeps the switch state (from
+                 localStorage) from causing a hydration mismatch -->
+            <ClientOnly>
+              <div class="grid grid-cols-[auto_auto_auto_1fr] items-start gap-x-3 gap-y-4">
+                <!-- OSV -->
+                <span class="flex w-5 justify-center pt-0.5">
+                  <SecuritySourceLogo source="osv" class="h-4" />
+                </span>
+                <label :for="osvSwitchId" class="text-sm text-fg font-medium cursor-pointer pt-px">
+                  {{ $t('settings.security_sources.osv') }}
+                </label>
+                <SettingsSwitch
+                  :id="osvSwitchId"
+                  :aria-label="$t('settings.security_sources.osv')"
+                  v-model="settings.securitySources.osv"
+                />
+                <p class="text-sm text-fg-muted min-w-0 mt-px">
+                  {{ $t('settings.security_sources.osv_description') }}
+                </p>
+
+                <div class="col-span-4 border-t border-border" />
+
+                <!-- Socket -->
+                <span class="flex w-5 justify-center pt-0.5">
+                  <SecuritySourceLogo source="socket" class="h-4" />
+                </span>
+                <label
+                  :for="socketSwitchId"
+                  class="text-sm font-medium pt-px"
+                  :class="
+                    sourceAvailability.socket
+                      ? 'text-fg cursor-pointer'
+                      : 'text-fg-muted cursor-not-allowed'
+                  "
+                >
+                  {{ $t('settings.security_sources.socket') }}
+                </label>
+                <SettingsSwitch
+                  :id="socketSwitchId"
+                  :aria-label="$t('settings.security_sources.socket')"
+                  :disabled="!sourceAvailability.socket"
+                  v-model="socketEnabled"
+                />
+                <div class="min-w-0 mt-px">
+                  <p class="text-sm text-fg-muted">
+                    {{ $t('settings.security_sources.socket_description') }}
+                  </p>
+                  <p
+                    v-if="!sourceAvailability.socket"
+                    class="text-xs text-fg-subtle mt-1 flex items-center gap-1"
+                  >
+                    <span class="i-lucide:info w-3 h-3 shrink-0" aria-hidden="true" />
+                    {{ $t('settings.security_sources.unavailable_on_deployment') }}
+                  </p>
+                </div>
+              </div>
+
+              <template #fallback>
+                <div
+                  class="grid grid-cols-[auto_auto_auto_1fr] items-center gap-x-3 gap-y-4"
+                  aria-hidden="true"
+                >
+                  <template v-for="i in 2" :key="i">
+                    <SkeletonBlock class="h-4 w-5" />
+                    <SkeletonBlock class="h-4 w-14" />
+                    <SkeletonBlock class="h-6 w-11 rounded-full" />
+                    <SkeletonBlock class="h-4 w-full max-w-md" />
+                  </template>
+                </div>
+              </template>
+            </ClientOnly>
+
+            <!-- Warning when every source is disabled -->
+            <SecuritySourcesWarning
+              v-if="!anySourceEnabled"
+              :show-settings-link="false"
+              class="mt-4"
+            />
+          </div>
+        </section>
+
         <!-- LANGUAGE Section -->
         <section>
           <h2 class="text-xs text-fg-muted uppercase tracking-wider mb-4">
diff --git a/app/utils/compare-scatter-chart.ts b/app/utils/compare-scatter-chart.ts
index d78f53f115..f60498987f 100644
--- a/app/utils/compare-scatter-chart.ts
+++ b/app/utils/compare-scatter-chart.ts
@@ -66,6 +66,9 @@ function getNumericFacetValue(
         ? packageData.vulnerabilities.count
         : null
 
+    case 'supplyChainAlerts':
+      return isFiniteNumber(packageData.supplyChainAlerts) ? packageData.supplyChainAlerts : null
+
     case 'types':
       return packageData.analysis?.types?.kind ? 1 : 0
 
diff --git a/docs/content/2.guide/1.features.md b/docs/content/2.guide/1.features.md
index 758329252d..60b54a9f55 100644
--- a/docs/content/2.guide/1.features.md
+++ b/docs/content/2.guide/1.features.md
@@ -59,7 +59,9 @@ Packages display helpful badges:
 
 ### View security information
 
-- **Vulnerability warnings** - Security advisories from the OSV database
+- **Vulnerability warnings** - Security advisories from configurable security data sources: the OSV database, and Socket (socket.dev) on deployments with a Socket API key. Findings reported by both sources are merged and labeled, and Socket adds reachability analysis (whether the vulnerable code is actually reachable)
+- **Supply chain alerts** - High-signal Socket alerts such as known malware, typosquats, obfuscated code, and install scripts
+- **Security data source settings** - Each source can be toggled on the settings page; if every source is disabled, security surfaces show an explicit warning instead of data
 - **Deprecation notices** - Clear warnings for deprecated packages and versions
 - **Provenance indicators** - Verified build badges for packages with npm provenance
 - **Install script warnings** - Packages with install-time scripts are surfaced in the sidebar
diff --git a/docs/content/2.guide/6.badges.md b/docs/content/2.guide/6.badges.md
index 9cd0d3461c..db4d329297 100644
--- a/docs/content/2.guide/6.badges.md
+++ b/docs/content/2.guide/6.badges.md
@@ -19,7 +19,7 @@ npmx.dev offers many different SVG badges with stats about any package via its A
 - **downloads-week**: Displays weekly download statistics. :img{src="https://img.shields.io/badge/%23f97316-f97316" class="inline align-middle h-5 w-14"}
 - **downloads-month**: Alias for monthly download statistics. :img{src="https://img.shields.io/badge/%23f97316-f97316" class="inline align-middle h-5 w-14"}
 - **downloads-year**: Displays yearly download statistics. :img{src="https://img.shields.io/badge/%23f97316-f97316" class="inline align-middle h-5 w-14"}
-- **vulnerabilities**: Shows the number of vulnerabilities found via OSV. :img{src="https://img.shields.io/badge/%2322c55e-22c55e" class="inline align-middle h-5 w-14"} / :img{src="https://img.shields.io/badge/%23ef4444-ef4444" class="inline align-middle h-5 w-14"}
+- **vulnerabilities**: Shows the number of known vulnerabilities (found via OSV). Renders a gray `unknown` badge when the scan could not be performed, so a failed check is never mistaken for a clean result. :img{src="https://img.shields.io/badge/%2322c55e-22c55e" class="inline align-middle h-5 w-14"} / :img{src="https://img.shields.io/badge/%23ef4444-ef4444" class="inline align-middle h-5 w-14"} / :img{src="https://img.shields.io/badge/%2364748b-64748b" class="inline align-middle h-5 w-14"}
 - **dependencies**: Lists the total count of package dependencies. :img{src="https://img.shields.io/badge/%2306b6d4-06b6d4" class="inline align-middle h-5 w-14"}
 - **created**: Displays the date the package was first published. :img{src="https://img.shields.io/badge/%2364748b-64748b" class="inline align-middle h-5 w-14"}
 - **updated**: Displays the date of the most recent modification. :img{src="https://img.shields.io/badge/%2364748b-64748b" class="inline align-middle h-5 w-14"}
diff --git a/docs/content/index.md b/docs/content/index.md
index 012bd7ce8f..aa0dff7e82 100644
--- a/docs/content/index.md
+++ b/docs/content/index.md
@@ -45,7 +45,7 @@ links:
 :::u-page-feature{icon="i-lucide:keyboard" to="/guide/keyboard-shortcuts" title="Navigate with keyboard" description="Open the command palette with ⌘K on macOS or Ctrl+K on Windows and Linux. Press / to search. Use arrow keys to browse results."}
 :::
 
-:::u-page-feature{icon="i-lucide:shield-check" to="/guide/features" title="Check security" description="Vulnerability warnings from OSV database and provenance indicators for verified builds."}
+:::u-page-feature{icon="i-lucide:shield-check" to="/guide/features" title="Check security" description="Vulnerability warnings from OSV and Socket, supply chain alerts, and provenance indicators for verified builds."}
 :::
 
 :::u-page-feature{icon="i-lucide:users" to="/guide/features" title="Manage packages and orgs" description="Manage package access, owners, organization members, and teams from the browser."}
diff --git a/i18n/locales/en.json b/i18n/locales/en.json
index 9b0f6d1b82..f79ad43631 100644
--- a/i18n/locales/en.json
+++ b/i18n/locales/en.json
@@ -274,6 +274,7 @@
       "appearance": "Appearance",
       "display": "Display",
       "search": "Search features",
+      "security": "Security",
       "language": "Language",
       "keyboard_shortcuts": "Keyboard shortcuts"
     },
@@ -285,6 +286,15 @@
       "algolia": "Algolia",
       "algolia_description": "Uses Algolia for faster search, org and user pages."
     },
+    "security_sources": {
+      "label": "Security data sources",
+      "description": "Choose which sources npmx uses to show security and vulnerability information.",
+      "osv": "OSV",
+      "osv_description": "Open Source Vulnerabilities database (osv.dev). Aggregates advisories from GitHub Security Advisories, npm audit and other databases.",
+      "socket": "Socket",
+      "socket_description": "Socket (socket.dev) supply chain security analysis: known vulnerabilities with reachability, plus malware, typosquats and other supply-chain risks.",
+      "unavailable_on_deployment": "Unavailable on this deployment: no Socket API key is configured."
+    },
     "instant_search": "Instant search",
     "instant_search_description": "Navigates to the search page and updates the results as you type.",
     "relative_dates": "Relative dates",
@@ -333,6 +343,11 @@
     "enable_changelog_autoscroll": "Auto scroll to requested version",
     "enable_changelog_autoscroll_description": "Auto scroll to or close to the requested version at package changelog"
   },
+  "security_sources": {
+    "none_enabled": "Warning: no security data source is enabled",
+    "none_enabled_detail": "Security and vulnerability information is hidden and will not be shown.",
+    "manage_in_settings": "Manage security data sources in settings"
+  },
   "i18n": {
     "missing_keys": "{count} missing translation | {count} missing translations",
     "copy_keys": "Copy keys",
@@ -457,6 +472,7 @@
       "deps": "Deps",
       "install_size": "Install Size",
       "vulns": "Vulns",
+      "supply_chain": "Supply chain",
       "published": "Published",
       "published_tooltip": "Date {package}{'@'}{version} was published",
       "view_dependency_graph": "View dependency graph",
@@ -828,9 +844,35 @@
         "critical": "critical",
         "high": "high",
         "moderate": "moderate",
-        "low": "low"
+        "low": "low",
+        "unknown": "unknown"
       },
-      "fixed_in_title": "Fixed in version {version}"
+      "fixed_in_title": "Fixed in version {version}",
+      "alias_dispute": "{source} also lists {ids} for this advisory, which belong to a different advisory",
+      "reachability": {
+        "reachable": "reachable",
+        "maybe_reachable": "possibly reachable",
+        "unreachable": "not reachable"
+      }
+    },
+    "supply_chain": {
+      "alerts_found": "{alerts} supply chain alert | {alerts} supply chain alerts",
+      "in_packages": "in {packages} package | in {packages} packages",
+      "scan_failed": "Could not scan for supply chain alerts",
+      "not_scanned": "Socket is not enabled, so supply chain alerts were not scanned",
+      "show_all_packages": "show {count} affected package | show all {count} affected packages",
+      "types": {
+        "malware": "Known malware",
+        "gptMalware": "AI-detected potential malware",
+        "didYouMean": "Possible typosquat",
+        "gptDidYouMean": "AI-detected possible typosquat",
+        "troll": "Protestware or unwanted behavior",
+        "obfuscatedFile": "Obfuscated code",
+        "manifestConfusion": "Manifest confusion",
+        "installScripts": "Install scripts",
+        "telemetry": "Telemetry",
+        "unstableOwnership": "Unstable ownership"
+      }
     },
     "deprecated": {
       "label": "Deprecated",
@@ -1527,6 +1569,10 @@
           "label": "Vulnerabilities",
           "description": "Known security vulnerabilities"
         },
+        "supplyChainAlerts": {
+          "label": "Supply chain alerts",
+          "description": "Socket supply chain risk alerts (malware, typosquats, install scripts, ...)"
+        },
         "githubStars": {
           "label": "GitHub Stars",
           "description": "Number of stars on the GitHub repository"
diff --git a/i18n/schema.json b/i18n/schema.json
index 6c52266b5b..ccfa6ae7dd 100644
--- a/i18n/schema.json
+++ b/i18n/schema.json
@@ -826,6 +826,9 @@
             "search": {
               "type": "string"
             },
+            "security": {
+              "type": "string"
+            },
             "language": {
               "type": "string"
             },
@@ -859,6 +862,33 @@
           },
           "additionalProperties": false
         },
+        "security_sources": {
+          "type": "object",
+          "properties": {
+            "label": {
+              "type": "string"
+            },
+            "description": {
+              "type": "string"
+            },
+            "osv": {
+              "type": "string"
+            },
+            "osv_description": {
+              "type": "string"
+            },
+            "socket": {
+              "type": "string"
+            },
+            "socket_description": {
+              "type": "string"
+            },
+            "unavailable_on_deployment": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
         "instant_search": {
           "type": "string"
         },
@@ -1003,6 +1033,21 @@
       },
       "additionalProperties": false
     },
+    "security_sources": {
+      "type": "object",
+      "properties": {
+        "none_enabled": {
+          "type": "string"
+        },
+        "none_enabled_detail": {
+          "type": "string"
+        },
+        "manage_in_settings": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
     "i18n": {
       "type": "object",
       "properties": {
@@ -1375,6 +1420,9 @@
             "vulns": {
               "type": "string"
             },
+            "supply_chain": {
+              "type": "string"
+            },
             "published": {
               "type": "string"
             },
@@ -2490,12 +2538,90 @@
                 },
                 "low": {
                   "type": "string"
+                },
+                "unknown": {
+                  "type": "string"
                 }
               },
               "additionalProperties": false
             },
             "fixed_in_title": {
               "type": "string"
+            },
+            "alias_dispute": {
+              "type": "string"
+            },
+            "reachability": {
+              "type": "object",
+              "properties": {
+                "reachable": {
+                  "type": "string"
+                },
+                "maybe_reachable": {
+                  "type": "string"
+                },
+                "unreachable": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "additionalProperties": false
+        },
+        "supply_chain": {
+          "type": "object",
+          "properties": {
+            "alerts_found": {
+              "type": "string"
+            },
+            "in_packages": {
+              "type": "string"
+            },
+            "scan_failed": {
+              "type": "string"
+            },
+            "not_scanned": {
+              "type": "string"
+            },
+            "show_all_packages": {
+              "type": "string"
+            },
+            "types": {
+              "type": "object",
+              "properties": {
+                "malware": {
+                  "type": "string"
+                },
+                "gptMalware": {
+                  "type": "string"
+                },
+                "didYouMean": {
+                  "type": "string"
+                },
+                "gptDidYouMean": {
+                  "type": "string"
+                },
+                "troll": {
+                  "type": "string"
+                },
+                "obfuscatedFile": {
+                  "type": "string"
+                },
+                "manifestConfusion": {
+                  "type": "string"
+                },
+                "installScripts": {
+                  "type": "string"
+                },
+                "telemetry": {
+                  "type": "string"
+                },
+                "unstableOwnership": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
             }
           },
           "additionalProperties": false
@@ -4585,6 +4711,18 @@
                   },
                   "additionalProperties": false
                 },
+                "supplyChainAlerts": {
+                  "type": "object",
+                  "properties": {
+                    "label": {
+                      "type": "string"
+                    },
+                    "description": {
+                      "type": "string"
+                    }
+                  },
+                  "additionalProperties": false
+                },
                 "githubStars": {
                   "type": "object",
                   "properties": {
diff --git a/modules/runtime/server/cache.ts b/modules/runtime/server/cache.ts
index 5359f75ea4..995ae37b93 100644
--- a/modules/runtime/server/cache.ts
+++ b/modules/runtime/server/cache.ts
@@ -66,22 +66,136 @@ function getFixturePath(type: FixtureType, name: string): string {
   return `${dir}:${filename.replace(/\//g, ':')}`
 }
 
-function getMockForUrl(url: string): MockResult | null {
+/**
+ * Package with fabricated security findings in fixture mode, so e2e tests can
+ * exercise non-empty vulnerability/supply-chain states (OSV+Socket merging,
+ * reachability, source tags). Keyed by name only to be robust to version
+ * drift. No other fixture package depends on it.
+ */
+const SECURITY_FIXTURE_PACKAGE = 'is-odd'
+
+/** GHSA reported by both OSV and Socket (exercises merge/dedup) */
+const SECURITY_FIXTURE_SHARED_GHSA = 'GHSA-npmx-test-0001'
+/** GHSA reported only by Socket (exercises socket-only findings) */
+const SECURITY_FIXTURE_SOCKET_GHSA = 'GHSA-npmx-test-0002'
+
+function parseJsonBody(body: unknown): unknown {
+  if (typeof body !== 'string') return body ?? null
+  try {
+    return JSON.parse(body)
+  } catch {
+    return null
+  }
+}
+
+function mockOsvBatchResults(body: unknown): { results: Array<{ vulns?: unknown[] }> } {
+  const parsed = parseJsonBody(body) as {
+    queries?: Array<{ package?: { name?: string } }>
+  } | null
+  const queries = parsed?.queries ?? []
+  return {
+    results: queries.map(query =>
+      query?.package?.name === SECURITY_FIXTURE_PACKAGE
+        ? { vulns: [{ id: SECURITY_FIXTURE_SHARED_GHSA, modified: '2024-01-01T00:00:00Z' }] }
+        : {},
+    ),
+  }
+}
+
+function mockOsvQueryResult(body: unknown): { vulns: unknown[] } {
+  const parsed = parseJsonBody(body) as { package?: { name?: string } } | null
+  if (parsed?.package?.name !== SECURITY_FIXTURE_PACKAGE) return { vulns: [] }
+  return {
+    vulns: [
+      {
+        id: SECURITY_FIXTURE_SHARED_GHSA,
+        summary: 'Test fixture vulnerability (shared between OSV and Socket)',
+        modified: '2024-01-01T00:00:00Z',
+        aliases: ['CVE-2024-00001'],
+        database_specific: { severity: 'HIGH' },
+        affected: [
+          {
+            package: { ecosystem: 'npm', name: SECURITY_FIXTURE_PACKAGE },
+            ranges: [{ type: 'SEMVER', events: [{ introduced: '0' }, { fixed: '99.0.0' }] }],
+          },
+        ],
+      },
+    ],
+  }
+}
+
+function mockSocketPurlArtifacts(body: unknown): unknown[] {
+  const parsed = parseJsonBody(body) as { components?: Array<{ purl?: string }> } | null
+  const components = parsed?.components ?? []
+  const fixturePurl = components.find(component =>
+    component?.purl?.startsWith(`pkg:npm/${SECURITY_FIXTURE_PACKAGE}@`),
+  )?.purl
+  if (!fixturePurl) return []
+
+  const version = fixturePurl.split('@').pop() ?? '0.0.0'
+
+  return [
+    {
+      type: 'npm',
+      name: SECURITY_FIXTURE_PACKAGE,
+      version,
+      alerts: [
+        {
+          key: 'fixture-alert-shared',
+          type: 'cve',
+          severity: 'high',
+          category: 'vulnerability',
+          props: {
+            ghsaId: SECURITY_FIXTURE_SHARED_GHSA,
+            cveId: 'CVE-2024-00001',
+            title: 'Test fixture vulnerability (shared between OSV and Socket)',
+            reachability: 'reachable',
+          },
+        },
+        {
+          key: 'fixture-alert-socket-only',
+          type: 'mediumCVE',
+          severity: 'medium',
+          category: 'vulnerability',
+          props: {
+            ghsaId: SECURITY_FIXTURE_SOCKET_GHSA,
+            title: 'Test fixture vulnerability (Socket only)',
+            reachability: 'unreachable',
+          },
+        },
+        {
+          key: 'fixture-alert-troll',
+          type: 'troll',
+          severity: 'medium',
+          category: 'supplyChainRisk',
+          props: {},
+        },
+      ],
+    },
+  ]
+}
+
+function getMockForUrl(url: string, requestBody?: unknown): MockResult | null {
   const urlObj = URL.parse(url)
   if (!urlObj) return null
 
   const { host, pathname, searchParams } = urlObj
 
-  // OSV API - return empty vulnerability results
+  // OSV API - empty results except for the designated security fixture package
   if (host === 'api.osv.dev') {
     if (pathname === '/v1/querybatch') {
-      return { data: { results: [] } }
+      return { data: mockOsvBatchResults(requestBody) }
     }
     if (pathname.startsWith('/v1/query')) {
-      return { data: { vulns: [] } }
+      return { data: mockOsvQueryResult(requestBody) }
     }
   }
 
+  // Socket batch purl API - artifacts only for the security fixture package
+  if (host === 'api.socket.dev' && /^\/v0\/orgs\/[^/]+\/purl$/.test(pathname)) {
+    return { data: mockSocketPurlArtifacts(requestBody) }
+  }
+
   // JSR registry - return null (npm packages aren't on JSR)
   if (host === 'jsr.io' && pathname.endsWith('/meta.json')) {
     return { data: null }
@@ -559,9 +673,10 @@ async function handleJsdelivrDataApi(
 async function fetchFromFixtures<T>(
   url: string,
   storage: ReturnType<typeof useStorage>,
+  requestBody?: unknown,
 ): Promise<CachedFetchResult<T>> {
-  // Check for mock responses (OSV, JSR)
-  const mockResult = getMockForUrl(url)
+  // Check for mock responses (OSV, Socket, JSR)
+  const mockResult = getMockForUrl(url, requestBody)
   if (mockResult) {
     if (VERBOSE) process.stdout.write(`[test-fixtures] Mock: ${url}\n`)
     return { data: mockResult.data as T, isStale: false, cachedAt: Date.now() }
@@ -846,7 +961,7 @@ export default defineNitroPlugin(nitroApp => {
     }
 
     try {
-      const res = await fetchFromFixtures(urlStr, storage)
+      const res = await fetchFromFixtures(urlStr, storage, init?.body)
       if (res.data) {
         return new Response(JSON.stringify(res.data), {
           status: 200,
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 29a38fa651..ca4c1311a8 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -41,6 +41,13 @@ export default defineNuxtConfig({
     github: {
       orgToken: '',
     },
+    // Socket (socket.dev) security data source; set NUXT_SOCKET_API_KEY and
+    // NUXT_SOCKET_ORG_SLUG. Without a key, the Socket source reports itself
+    // as unconfigured and is shown as unavailable in the UI.
+    socket: {
+      apiKey: '',
+      orgSlug: '',
+    },
     oauthJwkOne: process.env.OAUTH_JWK_ONE || undefined,
     // Upstash Redis for distributed OAuth token refresh locking in production
     upstash: {
@@ -54,6 +61,12 @@ export default defineNuxtConfig({
         apiKey: 'f54e21fa3a2a0160595bb058179bfb1e',
         indexName: 'npm-search',
       },
+      // Whether the Socket security data source is configured on this
+      // deployment. Derived from the private credentials at build/dev time;
+      // deployments that only set the key at runtime must also set
+      // NUXT_PUBLIC_SOCKET_CONFIGURED=true. Only the boolean is public - the
+      // key itself stays in private runtimeConfig.
+      socketConfigured: !!(process.env.NUXT_SOCKET_API_KEY && process.env.NUXT_SOCKET_ORG_SLUG),
     },
   },
 
diff --git a/playwright.config.ts b/playwright.config.ts
index 8c3c6aadb0..a6ba4f771f 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -19,6 +19,16 @@ export default defineConfig<ConfigOptions>({
     url: baseURL,
     reuseExistingServer: !process.env.CI,
     timeout: 60_000,
+    env: {
+      ...process.env,
+      // Dummy Socket credentials so the Socket security source is active in
+      // e2e; actual API calls are intercepted by the fixture plugin
+      // (modules/runtime/server/cache.ts). The public flag must be set
+      // explicitly because the build runs without the credentials.
+      NUXT_SOCKET_API_KEY: 'npmx-test-fixture-key',
+      NUXT_SOCKET_ORG_SLUG: 'npmx-test-fixtures',
+      NUXT_PUBLIC_SOCKET_CONFIGURED: 'true',
+    },
   },
   // Start/stop mock connector server before/after all tests (teardown via returned closure)
   globalSetup: join(import.meta.dirname, 'test/e2e/global-setup.ts'),
diff --git a/server/api/registry/badge/[type]/[...pkg].get.ts b/server/api/registry/badge/[type]/[...pkg].get.ts
index f9c0836807..d2a6874067 100644
--- a/server/api/registry/badge/[type]/[...pkg].get.ts
+++ b/server/api/registry/badge/[type]/[...pkg].get.ts
@@ -8,9 +8,9 @@ import { fetchNpmPackage } from '#server/utils/npm'
 import { assertValidPackageName, normalizeLicense } from '#shared/utils/npm'
 import { fetchPackageWithTypesAndFiles } from '#server/utils/file-tree'
 import { handleApiError } from '#server/utils/error-handler'
+import { fetchOsvVulnerabilityCount } from '#server/utils/osv'
 
 const NPM_DOWNLOADS_API = 'https://api.npmjs.org/downloads/point'
-const OSV_QUERY_API = 'https://api.osv.dev/v1/query'
 const BUNDLEPHOBIA_API = 'https://bundlephobia.com/api/size'
 
 const SafeStringSchema = v.pipe(v.string(), v.regex(/^[^<>"&]*$/, 'Invalid characters'))
@@ -513,22 +513,6 @@ async function fetchDownloads(
   }
 }
 
-async function fetchVulnerabilities(packageName: string, version: string): Promise<number> {
-  try {
-    const response = await fetch(OSV_QUERY_API, {
-      method: 'POST',
-      body: JSON.stringify({
-        version,
-        package: { name: packageName, ecosystem: 'npm' },
-      }),
-    })
-    const data = await response.json()
-    return data.vulns?.length ?? 0
-  } catch {
-    return 0
-  }
-}
-
 async function fetchInstallSize(packageName: string, version: string): Promise<number | null> {
   try {
     const response = await fetch(`${BUNDLEPHOBIA_API}?package=${packageName}@${version}`)
@@ -598,7 +582,12 @@ const badgeStrategies = {
 
   'vulnerabilities': async (pkgData: globalThis.Packument) => {
     const latest = getLatestVersion(pkgData)
-    const count = latest ? await fetchVulnerabilities(pkgData.name, latest) : 0
+    const count = latest ? await fetchOsvVulnerabilityCount(pkgData.name, latest) : null
+    // Distinguish "could not check" from "no known vulnerabilities" - a failed
+    // scan must not render the reassuring green zero badge
+    if (count === null) {
+      return { label: 'vulns', value: 'unknown', color: COLORS.slate }
+    }
     const isSafe = count === 0
     const color = isSafe ? COLORS.green : COLORS.red
     return { label: 'vulns', value: String(count), color }
diff --git a/server/api/registry/vulnerabilities/[...pkg].get.ts b/server/api/registry/vulnerabilities/[...pkg].get.ts
index 1dac0ab364..b6dfef5e9d 100644
--- a/server/api/registry/vulnerabilities/[...pkg].get.ts
+++ b/server/api/registry/vulnerabilities/[...pkg].get.ts
@@ -1,6 +1,6 @@
 import * as v from 'valibot'
 import { PackageRouteParamsSchema } from '#shared/schemas/package'
-import { CACHE_MAX_AGE_ONE_HOUR } from '#shared/utils/constants'
+import { CACHE_MAX_AGE_FIVE_MINUTES } from '#shared/utils/constants'
 
 /**
  * GET /api/registry/vulnerabilities/:name or /api/registry/vulnerabilities/:name/v/:version
@@ -41,11 +41,14 @@ export default defineCachedEventHandler(
     }
   },
   {
-    maxAge: CACHE_MAX_AGE_ONE_HOUR,
+    // Short response cache (matching the /api/** ISR rule) so freshness is
+    // governed by the analyzeDependencyTree function cache, which keeps
+    // complete results for an hour but revalidates degraded ones quickly
+    maxAge: CACHE_MAX_AGE_FIVE_MINUTES,
     swr: true,
     getKey: event => {
       const pkg = getRouterParam(event, 'pkg') ?? ''
-      return `vulnerabilities:v1:${pkg.replace(/\/+$/, '').trim()}`
+      return `vulnerabilities:v3:${pkg.replace(/\/+$/, '').trim()}`
     },
   },
 )
diff --git a/server/utils/dependency-analysis.ts b/server/utils/dependency-analysis.ts
index 0b42ee636e..d74f741189 100644
--- a/server/utils/dependency-analysis.ts
+++ b/server/utils/dependency-analysis.ts
@@ -1,264 +1,248 @@
 import type {
-  OsvQueryResponse,
-  OsvBatchResponse,
-  OsvVulnerability,
-  OsvSeverityLevel,
-  VulnerabilitySummary,
   DependencyDepth,
+  OsvSeverityLevel,
+  PackageSupplyChainInfo,
   PackageVulnerabilityInfo,
+  SecuritySourceStatus,
+  VulnerabilitySummary,
   VulnerabilityTreeResult,
   DeprecatedPackageInfo,
-  OsvAffected,
-  OsvRange,
 } from '#shared/types/dependency-analysis'
 import { mapWithConcurrency } from '#shared/utils/async'
 import { resolveDependencyTree } from './dependency-resolver'
-import { compare, isGreaterOrEqual, isLess } from 'verkit'
+import { queryOsvBatch, queryOsvDetails, type PackageQueryInfo } from './osv'
+import {
+  querySocketForTree,
+  strongerReachability,
+  type SocketTreeScan,
+  type SocketVulnerabilityFinding,
+} from './socket'
+import { countBySeverity, hasTransientSourceFailure } from '#shared/utils/security-sources'
+import { CACHE_MAX_AGE_FIVE_MINUTES } from '#shared/utils/constants'
 
 /** Maximum concurrent requests for fetching vulnerability details */
 const OSV_DETAIL_CONCURRENCY = 25
 
-/** Package info needed for OSV queries */
-interface PackageQueryInfo {
-  name: string
-  version: string
-  depth: DependencyDepth
-  path: string[]
+const DEPTH_ORDER: Record<DependencyDepth, number> = { root: 0, direct: 1, transitive: 2 }
+
+const SEVERITY_ORDER: Record<OsvSeverityLevel, number> = {
+  critical: 0,
+  high: 1,
+  moderate: 2,
+  low: 3,
+  unknown: 4,
 }
 
 /**
- * Query OSV batch API to find which packages have vulnerabilities.
- * Returns indices of packages that have vulnerabilities (for follow-up detailed queries).
- * @see https://google.github.io/osv.dev/post-v1-querybatch/
+ * Scan the tree via OSV: batch discovery, then detail queries for packages
+ * with known vulnerabilities.
  */
-async function queryOsvBatch(
-  packages: PackageQueryInfo[],
-): Promise<{ vulnerableIndices: number[]; failed: boolean }> {
-  if (packages.length === 0) return { vulnerableIndices: [], failed: false }
-
-  try {
-    const response = await $fetch<OsvBatchResponse>('https://api.osv.dev/v1/querybatch', {
-      method: 'POST',
-      body: {
-        queries: packages.map(pkg => ({
-          package: { name: pkg.name, ecosystem: 'npm' },
-          version: pkg.version,
-        })),
-      },
-    })
+async function runOsvScan(packages: PackageQueryInfo[]): Promise<{
+  vulnerablePackages: PackageVulnerabilityInfo[]
+  failedQueries: number
+  status: SecuritySourceStatus
+}> {
+  // Step 1: Use batch API to find which packages have vulnerabilities
+  // This is much faster than individual queries - one request for all packages
+  const { vulnerableIndices, failed: batchFailed } = await queryOsvBatch(packages)
+
+  const vulnerablePackages: PackageVulnerabilityInfo[] = []
+  let failedQueries = batchFailed ? packages.length : 0
+
+  if (!batchFailed && vulnerableIndices.length > 0) {
+    // Step 2: Fetch full vulnerability details only for packages with vulns
+    // This is typically a small fraction of total packages
+    const detailResults = await mapWithConcurrency(
+      vulnerableIndices,
+      i => queryOsvDetails(packages[i]!),
+      OSV_DETAIL_CONCURRENCY,
+    )
 
-    // Find indices of packages that have vulnerabilities
-    const vulnerableIndices: number[] = []
-    for (let i = 0; i < response.results.length; i++) {
-      const result = response.results[i]
-      if (result?.vulns && result.vulns.length > 0) {
-        vulnerableIndices.push(i)
-      }
-      // Warn if pagination token present (>1000 vulns for single query or >3000 total)
-      // This is extremely unlikely for npm packages but log for visibility
-      if (result?.next_page_token) {
-        // oxlint-disable-next-line no-console -- warn about paginated results
-        console.warn(
-          `[dep-analysis] OSV batch result has pagination token for package index ${i} ` +
-            `(${packages[i]?.name}@${packages[i]?.version}) - some vulnerabilities may be missing`,
-        )
+    for (const result of detailResults) {
+      if (result) {
+        vulnerablePackages.push(result)
+      } else {
+        failedQueries++
       }
     }
-
-    return { vulnerableIndices, failed: false }
-  } catch (error) {
-    // oxlint-disable-next-line no-console -- log OSV API failures for debugging
-    console.warn(`[dep-analysis] OSV batch query failed:`, error)
-    return { vulnerableIndices: [], failed: true }
   }
+
+  const status: SecuritySourceStatus = batchFailed ? 'failed' : failedQueries > 0 ? 'partial' : 'ok'
+
+  return { vulnerablePackages, failedQueries, status }
 }
 
 /**
- * Query OSV for full vulnerability details for a single package.
- * Only called for packages known to have vulnerabilities.
+ * Locate the existing entry a Socket finding refers to. Match strength is
+ * evaluated across ALL entries before weakening: alias groups (e.g. OSV
+ * expands aliases to the whole group) can join distinct advisories, even
+ * cross-listing each other's GHSA and CVE ids - so an exact primary-id match
+ * anywhere must beat any alias match, and a finding that names one GHSA must
+ * never CVE-merge into an entry whose primary id is a different GHSA.
  */
-async function queryOsvDetails(pkg: PackageQueryInfo): Promise<PackageVulnerabilityInfo | null> {
-  try {
-    const response = await $fetch<OsvQueryResponse>('https://api.osv.dev/v1/query', {
-      method: 'POST',
-      body: {
-        package: { name: pkg.name, ecosystem: 'npm' },
-        version: pkg.version,
-      },
-    })
-
-    const vulns = response.vulns || []
-    if (vulns.length === 0) return null
-
-    const counts = { total: vulns.length, critical: 0, high: 0, moderate: 0, low: 0 }
-    const vulnerabilities: VulnerabilitySummary[] = []
-
-    const severityOrder: Record<OsvSeverityLevel, number> = {
-      critical: 0,
-      high: 1,
-      moderate: 2,
-      low: 3,
-      unknown: 4,
-    }
-
-    const sortedVulns = [...vulns].sort(
-      (a, b) => severityOrder[getSeverityLevel(a)] - severityOrder[getSeverityLevel(b)],
-    )
-
-    for (const vuln of sortedVulns) {
-      const severity = getSeverityLevel(vuln)
-      if (severity === 'critical') counts.critical++
-      else if (severity === 'high') counts.high++
-      else if (severity === 'moderate') counts.moderate++
-      else if (severity === 'low') counts.low++
-
-      vulnerabilities.push({
-        id: vuln.id,
-        summary: vuln.summary || 'No description available',
-        severity,
-        aliases: vuln.aliases || [],
-        url: getVulnerabilityUrl(vuln),
-        fixedIn: getFixedVersion(vuln.affected, pkg.name, pkg.version),
-      })
-    }
-
-    return {
-      name: pkg.name,
-      version: pkg.version,
-      depth: pkg.depth,
-      path: pkg.path,
-      vulnerabilities,
-      counts,
-    }
-  } catch (error) {
-    // oxlint-disable-next-line no-console -- log OSV API failures for debugging
-    console.warn(`[dep-analysis] OSV detail query failed for ${pkg.name}@${pkg.version}:`, error)
-    return null
+function findMatchingVulnerability(
+  vulnerabilities: VulnerabilitySummary[],
+  finding: SocketVulnerabilityFinding,
+): VulnerabilitySummary | undefined {
+  // identical ids (including synthetic SOCKET-* ids) refer to the same entry
+  const exact = vulnerabilities.find(vuln => vuln.id === finding.id)
+  if (exact) return exact
+
+  if (finding.ghsaId) {
+    const ghsaId = finding.ghsaId
+    const byGhsaId = vulnerabilities.find(vuln => vuln.id === ghsaId)
+    if (byGhsaId) return byGhsaId
+    const byGhsaAlias = vulnerabilities.find(vuln => vuln.aliases.includes(ghsaId))
+    if (byGhsaAlias) return byGhsaAlias
   }
-}
 
-function getVulnerabilityUrl(vuln: OsvVulnerability): string {
-  if (vuln.id.startsWith('GHSA-')) {
-    return `https://github.com/advisories/${vuln.id}`
-  }
-  const cveAlias = vuln.aliases?.find(a => a.startsWith('CVE-'))
-  if (cveAlias) {
-    return `https://nvd.nist.gov/vuln/detail/${cveAlias}`
-  }
-  return `https://osv.dev/vulnerability/${vuln.id}`
+  if (!finding.cveId) return undefined
+  const cveId = finding.cveId
+  return vulnerabilities.find(
+    vuln =>
+      (vuln.id === cveId || vuln.aliases.includes(cveId)) &&
+      !(finding.ghsaId && vuln.id.startsWith('GHSA-') && vuln.id !== finding.ghsaId),
+  )
 }
 
 /**
- * Parse OSV range events into introduced/fixed pairs.
- * OSV events form a timeline: [introduced, fixed, introduced, fixed, ...]
- * A single range can have multiple introduced/fixed pairs representing
- * periods where the vulnerability was active, was fixed, and was reintroduced.
- * @see https://ossf.github.io/osv-schema/#affectedrangesevents-fields
+ * Merge Socket vulnerability findings into the OSV results. Findings for the
+ * same advisory (matched by GHSA/CVE id or alias) are merged into a single
+ * entry tagged with both sources; Socket-only findings become new entries.
  */
-function parseRangeIntervals(range: OsvRange): Array<{ introduced: string; fixed?: string }> {
-  const intervals: Array<{ introduced: string; fixed?: string }> = []
-  let currentIntroduced: string | undefined
-
-  for (const event of range.events) {
-    if (event.introduced !== undefined) {
-      // Start a new interval (close previous open one if any)
-      if (currentIntroduced !== undefined) {
-        intervals.push({ introduced: currentIntroduced })
+function mergeSocketFindings(
+  vulnerablePackages: PackageVulnerabilityInfo[],
+  packagesByKey: Map<string, PackageQueryInfo>,
+  socketVulnerabilities: Map<string, SocketVulnerabilityFinding[]>,
+): PackageVulnerabilityInfo[] {
+  const byKey = new Map(vulnerablePackages.map(pkg => [`${pkg.name}@${pkg.version}`, pkg]))
+
+  for (const [key, findings] of socketVulnerabilities) {
+    const treePackage = packagesByKey.get(key)
+    // Socket may return artifacts we did not ask about (e.g. resolution
+    // differences); ignore anything outside the resolved tree
+    if (!treePackage) continue
+
+    let entry = byKey.get(key)
+    if (!entry) {
+      entry = {
+        name: treePackage.name,
+        version: treePackage.version,
+        depth: treePackage.depth,
+        path: treePackage.path,
+        vulnerabilities: [],
+        counts: { total: 0, critical: 0, high: 0, moderate: 0, low: 0 },
+      }
+      byKey.set(key, entry)
+    }
+
+    for (const finding of findings) {
+      const existing = findMatchingVulnerability(entry.vulnerabilities, finding)
+      if (existing) {
+        if (!existing.sources.includes('socket')) existing.sources.push('socket')
+        if (finding.reachability) {
+          // multiple Socket alerts can reference the same advisory - keep
+          // the strongest (most alarming) reachability verdict
+          existing.reachability = strongerReachability(existing.reachability, finding.reachability)
+        }
+        existing.fixedIn ??= finding.fixedIn
+        existing.cveId ??= finding.cveId
+      } else {
+        const aliases = [finding.ghsaId, finding.cveId].filter(
+          (alias): alias is string => !!alias && alias !== finding.id,
+        )
+        entry.vulnerabilities.push({
+          id: finding.id,
+          summary: finding.summary,
+          severity: finding.severity,
+          aliases,
+          cveId: finding.cveId,
+          url: finding.url,
+          fixedIn: finding.fixedIn,
+          sources: ['socket'],
+          reachability: finding.reachability,
+        })
       }
-      currentIntroduced = event.introduced
-    } else if (event.fixed !== undefined && currentIntroduced !== undefined) {
-      intervals.push({ introduced: currentIntroduced, fixed: event.fixed })
-      currentIntroduced = undefined
     }
-  }
 
-  // Handle trailing introduced with no fixed (still vulnerable)
-  if (currentIntroduced !== undefined) {
-    intervals.push({ introduced: currentIntroduced })
+    entry.vulnerabilities.sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity])
+    entry.counts = countBySeverity(entry.vulnerabilities)
   }
 
-  return intervals
+  return [...byKey.values()]
 }
 
 /**
- * Extract the fixed version for a specific package version from vulnerability data.
- * Finds all intervals that contain the current version and returns the closest fix,
- * preferring a nearby backport over a distant major-version bump.
- * @see https://ossf.github.io/osv-schema/#affectedrangesevents-fields
+ * Repair alias-group pollution among a package's findings. OSV expands each
+ * record's aliases to the whole transitive alias group, so two distinct
+ * advisories (e.g. an original and its fix-bypass) can cross-list each
+ * other's GHSA and CVE ids. Two facts let us correct this: entries here are
+ * distinct advisories by their publisher's own account, so none may claim a
+ * sibling's primary id as an alias; and a CVE that a source explicitly
+ * paired with one advisory (cveId) cannot also alias a sibling.
  */
-function getFixedVersion(
-  affected: OsvAffected[] | undefined,
-  packageName: string,
-  currentVersion: string,
-): string | undefined {
-  if (!affected) return undefined
-
-  // Find all affected entries for this specific package
-  const packageAffectedEntries = affected.filter(
-    a => a.package.ecosystem === 'npm' && a.package.name === packageName,
-  )
-
-  // Collect all matching fixed versions across all ranges
-  const matchingFixedVersions: string[] = []
-
-  for (const entry of packageAffectedEntries) {
-    if (!entry.ranges) continue
-
-    for (const range of entry.ranges) {
-      // Only handle SEMVER ranges (most common for npm)
-      if (range.type !== 'SEMVER') continue
-
-      const intervals = parseRangeIntervals(range)
-      for (const interval of intervals) {
-        const introVersion = interval.introduced === '0' ? '0.0.0' : interval.introduced
-        try {
-          const afterIntro = isGreaterOrEqual(currentVersion, introVersion)
-          const beforeFixed = !interval.fixed || isLess(currentVersion, interval.fixed)
-          if (afterIntro && beforeFixed && interval.fixed) {
-            matchingFixedVersions.push(interval.fixed)
-          }
-        } catch {
-          continue
-        }
-      }
+function reconcileAliases(vulnerabilities: VulnerabilitySummary[]): void {
+  if (vulnerabilities.length < 2) return
+
+  const primaryIds = new Set(vulnerabilities.map(vuln => vuln.id))
+  // A CVE can legitimately be shared by two distinct advisories (two GHSAs,
+  // one CVE), so track the full set of source-declared owners per CVE; an
+  // alias is only disputed when its owner set excludes this entry entirely.
+  const cveOwners = new Map<string, Set<string>>()
+  for (const vuln of vulnerabilities) {
+    if (vuln.cveId) {
+      const owners = cveOwners.get(vuln.cveId) ?? new Set<string>()
+      owners.add(vuln.id)
+      cveOwners.set(vuln.cveId, owners)
     }
   }
 
-  if (matchingFixedVersions.length === 0) return undefined
-  if (matchingFixedVersions.length === 1) return matchingFixedVersions[0]
-
-  // Return the lowest (closest) fixed version — the smallest bump from the current version
-  return matchingFixedVersions.sort(compare)[0]
+  for (const vuln of vulnerabilities) {
+    const removed: string[] = []
+    vuln.aliases = vuln.aliases.filter(alias => {
+      const owners = cveOwners.get(alias)
+      const belongsToSibling =
+        (primaryIds.has(alias) && alias !== vuln.id) ||
+        (owners !== undefined && !owners.has(vuln.id))
+      if (belongsToSibling) removed.push(alias)
+      return !belongsToSibling
+    })
+    if (removed.length > 0) vuln.disputedAliases = removed
+  }
 }
 
-function getSeverityLevel(vuln: OsvVulnerability): OsvSeverityLevel {
-  const dbSeverity = vuln.database_specific?.severity?.toLowerCase()
-  if (dbSeverity) {
-    if (dbSeverity === 'critical') return 'critical'
-    if (dbSeverity === 'high') return 'high'
-    if (dbSeverity === 'moderate' || dbSeverity === 'medium') return 'moderate'
-    if (dbSeverity === 'low') return 'low'
+function buildSupplyChainPackages(
+  packagesByKey: Map<string, PackageQueryInfo>,
+  socketAlerts: SocketTreeScan['supplyChainAlerts'],
+): PackageSupplyChainInfo[] {
+  const result: PackageSupplyChainInfo[] = []
+  for (const [key, alerts] of socketAlerts) {
+    const treePackage = packagesByKey.get(key)
+    if (!treePackage || alerts.length === 0) continue
+    result.push({
+      name: treePackage.name,
+      version: treePackage.version,
+      depth: treePackage.depth,
+      path: treePackage.path,
+      alerts: [...alerts].sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]),
+    })
   }
 
-  const severityEntry = vuln.severity?.[0]
-  if (severityEntry?.score) {
-    const match = severityEntry.score.match(/(?:^|[/:])(\d+(?:\.\d+)?)$/)
-    if (match?.[1]) {
-      const score = parseFloat(match[1])
-      if (score >= 9.0) return 'critical'
-      if (score >= 7.0) return 'high'
-      if (score >= 4.0) return 'moderate'
-      if (score > 0) return 'low'
-    }
-  }
+  result.sort((a, b) => {
+    if (a.depth !== b.depth) return DEPTH_ORDER[a.depth] - DEPTH_ORDER[b.depth]
+    const aWorst = a.alerts[0] ? SEVERITY_ORDER[a.alerts[0].severity] : Number.MAX_SAFE_INTEGER
+    const bWorst = b.alerts[0] ? SEVERITY_ORDER[b.alerts[0].severity] : Number.MAX_SAFE_INTEGER
+    return aWorst - bWorst
+  })
 
-  return 'unknown'
+  return result
 }
 
 /**
- * Analyze entire dependency tree for vulnerabilities and deprecated packages.
- * Uses OSV batch API for efficient vulnerability discovery, then fetches
- * full details only for packages with known vulnerabilities.
+ * Analyze entire dependency tree for vulnerabilities, supply-chain alerts and
+ * deprecated packages. Queries all configured security data sources (OSV
+ * always; Socket when an API key is configured) and merges the findings,
+ * reporting per-source status.
  */
 export const analyzeDependencyTree = defineCachedFunction(
   async (name: string, version: string): Promise<VulnerabilityTreeResult> => {
@@ -273,6 +257,8 @@ export const analyzeDependencyTree = defineCachedFunction(
       path: pkg.path || [],
     }))
 
+    const packagesByKey = new Map(packages.map(pkg => [`${pkg.name}@${pkg.version}`, pkg]))
+
     // Collect deprecated packages (no API call needed - already in packument data)
     const deprecatedPackages: DeprecatedPackageInfo[] = [...resolved.values()]
       .filter(pkg => pkg.deprecated)
@@ -283,41 +269,27 @@ export const analyzeDependencyTree = defineCachedFunction(
         path: pkg.path || [],
         message: pkg.deprecated!,
       }))
-      .sort((a, b) => {
-        // Sort by depth (root → direct → transitive)
-        const depthOrder: Record<DependencyDepth, number> = { root: 0, direct: 1, transitive: 2 }
-        return depthOrder[a.depth] - depthOrder[b.depth]
-      })
-
-    // Step 1: Use batch API to find which packages have vulnerabilities
-    // This is much faster than individual queries - one request for all packages
-    const { vulnerableIndices, failed: batchFailed } = await queryOsvBatch(packages)
-
-    let vulnerablePackages: PackageVulnerabilityInfo[] = []
-    let failedQueries = batchFailed ? packages.length : 0
-
-    if (!batchFailed && vulnerableIndices.length > 0) {
-      // Step 2: Fetch full vulnerability details only for packages with vulns
-      // This is typically a small fraction of total packages
-      const detailResults = await mapWithConcurrency(
-        vulnerableIndices,
-        i => queryOsvDetails(packages[i]!),
-        OSV_DETAIL_CONCURRENCY,
-      )
+      .sort((a, b) => DEPTH_ORDER[a.depth] - DEPTH_ORDER[b.depth])
+
+    // Query all configured security data sources concurrently
+    const [osvScan, socketScan] = await Promise.all([
+      runOsvScan(packages),
+      querySocketForTree(packages),
+    ])
+
+    const vulnerablePackages = mergeSocketFindings(
+      osvScan.vulnerablePackages,
+      packagesByKey,
+      socketScan.vulnerabilities,
+    )
 
-      for (const result of detailResults) {
-        if (result) {
-          vulnerablePackages.push(result)
-        } else {
-          failedQueries++
-        }
-      }
+    for (const pkg of vulnerablePackages) {
+      reconcileAliases(pkg.vulnerabilities)
     }
 
     // Sort by depth (root → direct → transitive), then by severity
-    const depthOrder: Record<DependencyDepth, number> = { root: 0, direct: 1, transitive: 2 }
     vulnerablePackages.sort((a, b) => {
-      if (a.depth !== b.depth) return depthOrder[a.depth] - depthOrder[b.depth]
+      if (a.depth !== b.depth) return DEPTH_ORDER[a.depth] - DEPTH_ORDER[b.depth]
       if (a.counts.critical !== b.counts.critical) return b.counts.critical - a.counts.critical
       if (a.counts.high !== b.counts.high) return b.counts.high - a.counts.high
       if (a.counts.moderate !== b.counts.moderate) return b.counts.moderate - a.counts.moderate
@@ -334,8 +306,13 @@ export const analyzeDependencyTree = defineCachedFunction(
       totalCounts.low += pkg.counts.low
     }
 
-    // Log if batch query failed entirely
-    if (batchFailed) {
+    const supplyChainPackages = buildSupplyChainPackages(
+      packagesByKey,
+      socketScan.supplyChainAlerts,
+    )
+
+    // Log if the OSV batch query failed entirely
+    if (osvScan.status === 'failed') {
       // oxlint-disable-next-line no-console -- critical error logging
       console.error(
         `[dep-analysis] Critical: OSV batch query failed for ${name}@${version} (${packages.length} packages)`,
@@ -346,16 +323,28 @@ export const analyzeDependencyTree = defineCachedFunction(
       package: name,
       version,
       vulnerablePackages,
+      supplyChainPackages,
       deprecatedPackages,
       totalPackages: packages.length,
-      failedQueries,
+      failedQueries: osvScan.failedQueries,
       totalCounts,
+      sourceStatus: { osv: osvScan.status, socket: socketScan.status },
     }
   },
   {
     maxAge: 60 * 60,
     swr: true,
     name: 'dependency-analysis',
-    getKey: (name: string, version: string) => `v2:${name}@${version}`,
+    getKey: (name: string, version: string) => `v4:${name}@${version}`,
+    // Results degraded by a transient source failure (outage, quota
+    // exhaustion) are only served from cache briefly, so a blip doesn't
+    // strip findings from the cache for a whole hour after recovery
+    validate: entry => {
+      // a custom validate replaces nitro's default entry.value !== undefined guard
+      const result = entry.value
+      if (!result) return false
+      if (!hasTransientSourceFailure(result.sourceStatus)) return true
+      return Date.now() - (entry.mtime ?? 0) < CACHE_MAX_AGE_FIVE_MINUTES * 1000
+    },
   },
 )
diff --git a/server/utils/osv.ts b/server/utils/osv.ts
new file mode 100644
index 0000000000..7e627fb671
--- /dev/null
+++ b/server/utils/osv.ts
@@ -0,0 +1,299 @@
+import type {
+  OsvQueryResponse,
+  OsvBatchResponse,
+  OsvVulnerability,
+  OsvSeverityLevel,
+  VulnerabilitySummary,
+  DependencyDepth,
+  PackageVulnerabilityInfo,
+  OsvAffected,
+  OsvRange,
+} from '#shared/types/dependency-analysis'
+import { compare, isGreaterOrEqual, isLess } from 'verkit'
+
+const OSV_QUERY_API = 'https://api.osv.dev/v1/query'
+const OSV_QUERY_BATCH_API = 'https://api.osv.dev/v1/querybatch'
+
+// a stalled OSV connection would otherwise hang the whole security scan until
+// the platform request limit fires; degrade to the failed-source path instead
+const OSV_FETCH_TIMEOUT_MS = 10_000
+
+/** Package info needed for OSV queries */
+export interface PackageQueryInfo {
+  name: string
+  version: string
+  depth: DependencyDepth
+  path: string[]
+}
+
+/**
+ * Query OSV batch API to find which packages have vulnerabilities.
+ * Returns indices of packages that have vulnerabilities (for follow-up detailed queries).
+ * @see https://google.github.io/osv.dev/post-v1-querybatch/
+ */
+export async function queryOsvBatch(
+  packages: PackageQueryInfo[],
+): Promise<{ vulnerableIndices: number[]; failed: boolean }> {
+  if (packages.length === 0) return { vulnerableIndices: [], failed: false }
+
+  try {
+    const response = await $fetch<OsvBatchResponse>(OSV_QUERY_BATCH_API, {
+      method: 'POST',
+      timeout: OSV_FETCH_TIMEOUT_MS,
+      body: {
+        queries: packages.map(pkg => ({
+          package: { name: pkg.name, ecosystem: 'npm' },
+          version: pkg.version,
+        })),
+      },
+    })
+
+    // Find indices of packages that have vulnerabilities
+    const vulnerableIndices: number[] = []
+    for (let i = 0; i < response.results.length; i++) {
+      const result = response.results[i]
+      if (result?.vulns && result.vulns.length > 0) {
+        vulnerableIndices.push(i)
+      }
+      // Warn if pagination token present (>1000 vulns for single query or >3000 total)
+      // This is extremely unlikely for npm packages but log for visibility
+      if (result?.next_page_token) {
+        // oxlint-disable-next-line no-console -- warn about paginated results
+        console.warn(
+          `[dep-analysis] OSV batch result has pagination token for package index ${i} ` +
+            `(${packages[i]?.name}@${packages[i]?.version}) - some vulnerabilities may be missing`,
+        )
+      }
+    }
+
+    return { vulnerableIndices, failed: false }
+  } catch (error) {
+    // oxlint-disable-next-line no-console -- log OSV API failures for debugging
+    console.warn(`[dep-analysis] OSV batch query failed:`, error)
+    return { vulnerableIndices: [], failed: true }
+  }
+}
+
+/**
+ * Query OSV for full vulnerability details for a single package.
+ * Only called for packages known to have vulnerabilities.
+ */
+export async function queryOsvDetails(
+  pkg: PackageQueryInfo,
+): Promise<PackageVulnerabilityInfo | null> {
+  try {
+    const response = await $fetch<OsvQueryResponse>(OSV_QUERY_API, {
+      method: 'POST',
+      timeout: OSV_FETCH_TIMEOUT_MS,
+      body: {
+        package: { name: pkg.name, ecosystem: 'npm' },
+        version: pkg.version,
+      },
+    })
+
+    const vulns = response.vulns || []
+    if (vulns.length === 0) return null
+
+    const counts = { total: vulns.length, critical: 0, high: 0, moderate: 0, low: 0 }
+    const vulnerabilities: VulnerabilitySummary[] = []
+
+    const severityOrder: Record<OsvSeverityLevel, number> = {
+      critical: 0,
+      high: 1,
+      moderate: 2,
+      low: 3,
+      unknown: 4,
+    }
+
+    const sortedVulns = [...vulns].sort(
+      (a, b) => severityOrder[getSeverityLevel(a)] - severityOrder[getSeverityLevel(b)],
+    )
+
+    for (const vuln of sortedVulns) {
+      const severity = getSeverityLevel(vuln)
+      if (severity === 'critical') counts.critical++
+      else if (severity === 'high') counts.high++
+      else if (severity === 'moderate') counts.moderate++
+      else if (severity === 'low') counts.low++
+
+      vulnerabilities.push({
+        id: vuln.id,
+        summary: vuln.summary || 'No description available',
+        severity,
+        aliases: vuln.aliases || [],
+        url: getVulnerabilityUrl(vuln),
+        fixedIn: getFixedVersion(vuln.affected, pkg.name, pkg.version),
+        sources: ['osv'],
+      })
+    }
+
+    return {
+      name: pkg.name,
+      version: pkg.version,
+      depth: pkg.depth,
+      path: pkg.path,
+      vulnerabilities,
+      counts,
+    }
+  } catch (error) {
+    // oxlint-disable-next-line no-console -- log OSV API failures for debugging
+    console.warn(`[dep-analysis] OSV detail query failed for ${pkg.name}@${pkg.version}:`, error)
+    return null
+  }
+}
+
+/**
+ * Fetch the number of known vulnerabilities for a single package version.
+ * Returns `null` (not 0) when the OSV query fails, so callers can distinguish
+ * "no known vulnerabilities" from "could not check".
+ */
+export async function fetchOsvVulnerabilityCount(
+  name: string,
+  version: string,
+): Promise<number | null> {
+  try {
+    const response = await $fetch<OsvQueryResponse>(OSV_QUERY_API, {
+      method: 'POST',
+      timeout: OSV_FETCH_TIMEOUT_MS,
+      body: {
+        package: { name, ecosystem: 'npm' },
+        version,
+      },
+    })
+    return response.vulns?.length ?? 0
+  } catch (error) {
+    // oxlint-disable-next-line no-console -- log OSV API failures for debugging
+    console.warn(`[osv] vulnerability count query failed for ${name}@${version}:`, error)
+    return null
+  }
+}
+
+function getVulnerabilityUrl(vuln: OsvVulnerability): string {
+  if (vuln.id.startsWith('GHSA-')) {
+    return `https://github.com/advisories/${vuln.id}`
+  }
+  const cveAlias = vuln.aliases?.find(a => a.startsWith('CVE-'))
+  if (cveAlias) {
+    return `https://nvd.nist.gov/vuln/detail/${cveAlias}`
+  }
+  return `https://osv.dev/vulnerability/${vuln.id}`
+}
+
+/**
+ * Parse OSV range events into introduced/fixed pairs.
+ * OSV events form a timeline: [introduced, fixed, introduced, fixed, ...]
+ * A single range can have multiple introduced/fixed pairs representing
+ * periods where the vulnerability was active, was fixed, and was reintroduced.
+ * @see https://ossf.github.io/osv-schema/#affectedrangesevents-fields
+ */
+function parseRangeIntervals(range: OsvRange): Array<{ introduced: string; fixed?: string }> {
+  const intervals: Array<{ introduced: string; fixed?: string }> = []
+  let currentIntroduced: string | undefined
+
+  for (const event of range.events) {
+    if (event.introduced !== undefined) {
+      // Start a new interval (close previous open one if any)
+      if (currentIntroduced !== undefined) {
+        intervals.push({ introduced: currentIntroduced })
+      }
+      currentIntroduced = event.introduced
+    } else if (event.fixed !== undefined && currentIntroduced !== undefined) {
+      intervals.push({ introduced: currentIntroduced, fixed: event.fixed })
+      currentIntroduced = undefined
+    }
+  }
+
+  // Handle trailing introduced with no fixed (still vulnerable)
+  if (currentIntroduced !== undefined) {
+    intervals.push({ introduced: currentIntroduced })
+  }
+
+  return intervals
+}
+
+/**
+ * OSV SEMVER events sometimes carry shorthand versions (e.g. introduced
+ * "13.0" or "0"); pad the missing parts so semver comparisons don't reject
+ * the whole interval.
+ */
+function coerceSemver(version: string): string {
+  const parts = version.split('.')
+  while (parts.length < 3) parts.push('0')
+  return parts.join('.')
+}
+
+/**
+ * Extract the fixed version for a specific package version from vulnerability data.
+ * Finds all intervals that contain the current version and returns the closest fix,
+ * preferring a nearby backport over a distant major-version bump.
+ * @see https://ossf.github.io/osv-schema/#affectedrangesevents-fields
+ */
+function getFixedVersion(
+  affected: OsvAffected[] | undefined,
+  packageName: string,
+  currentVersion: string,
+): string | undefined {
+  if (!affected) return undefined
+
+  // Find all affected entries for this specific package
+  const packageAffectedEntries = affected.filter(
+    a => a.package.ecosystem === 'npm' && a.package.name === packageName,
+  )
+
+  // Collect all matching fixed versions across all ranges
+  const matchingFixedVersions: string[] = []
+
+  for (const entry of packageAffectedEntries) {
+    if (!entry.ranges) continue
+
+    for (const range of entry.ranges) {
+      // Only handle SEMVER ranges (most common for npm)
+      if (range.type !== 'SEMVER') continue
+
+      const intervals = parseRangeIntervals(range)
+      for (const interval of intervals) {
+        const introVersion = coerceSemver(interval.introduced)
+        const fixedVersion = interval.fixed ? coerceSemver(interval.fixed) : undefined
+        try {
+          const afterIntro = isGreaterOrEqual(currentVersion, introVersion)
+          const beforeFixed = !fixedVersion || isLess(currentVersion, fixedVersion)
+          if (afterIntro && beforeFixed && fixedVersion) {
+            matchingFixedVersions.push(fixedVersion)
+          }
+        } catch {
+          continue
+        }
+      }
+    }
+  }
+
+  if (matchingFixedVersions.length === 0) return undefined
+  if (matchingFixedVersions.length === 1) return matchingFixedVersions[0]
+
+  // Return the lowest (closest) fixed version — the smallest bump from the current version
+  return matchingFixedVersions.sort(compare)[0]
+}
+
+function getSeverityLevel(vuln: OsvVulnerability): OsvSeverityLevel {
+  const dbSeverity = vuln.database_specific?.severity?.toLowerCase()
+  if (dbSeverity) {
+    if (dbSeverity === 'critical') return 'critical'
+    if (dbSeverity === 'high') return 'high'
+    if (dbSeverity === 'moderate' || dbSeverity === 'medium') return 'moderate'
+    if (dbSeverity === 'low') return 'low'
+  }
+
+  const severityEntry = vuln.severity?.[0]
+  if (severityEntry?.score) {
+    const match = severityEntry.score.match(/(?:^|[/:])(\d+(?:\.\d+)?)$/)
+    if (match?.[1]) {
+      const score = parseFloat(match[1])
+      if (score >= 9.0) return 'critical'
+      if (score >= 7.0) return 'high'
+      if (score >= 4.0) return 'moderate'
+      if (score > 0) return 'low'
+    }
+  }
+
+  return 'unknown'
+}
diff --git a/server/utils/socket.ts b/server/utils/socket.ts
new file mode 100644
index 0000000000..181926f73c
--- /dev/null
+++ b/server/utils/socket.ts
@@ -0,0 +1,471 @@
+import type {
+  OsvSeverityLevel,
+  SecuritySourceStatus,
+  SupplyChainAlert,
+  SupplyChainAlertType,
+  VulnerabilityReachability,
+} from '#shared/types/dependency-analysis'
+import { getSocketPackageUrl } from '#shared/utils/security-sources'
+import { CACHE_MAX_AGE_ONE_DAY } from '#shared/utils/constants'
+
+const SOCKET_PURL_BATCH_LIMIT = 1024
+
+// A published package@version is immutable, so its Socket findings are stable
+// enough to cache for a day. This is the main quota lever: the batch-purl
+// endpoint bills a flat 100 units per request regardless of how many purls it
+// carries, so caching per purl means overlapping and revisited trees reuse
+// results and only never-before-seen versions cost a request.
+const SOCKET_PURL_CACHE_PREFIX = 'socket-purl:v1:'
+const SOCKET_PURL_CACHE_TTL_MS = CACHE_MAX_AGE_ONE_DAY * 1000
+
+// a stalled Socket connection would otherwise block the vulnerabilities
+// request until the platform limit fires; degrade to the failed path instead
+const SOCKET_FETCH_TIMEOUT_MS = 10_000
+
+/**
+ * How long to stop calling the Socket API after a quota/authorization
+ * rejection (429/403), so a public traffic spike can't burn through quota
+ * with doomed requests.
+ */
+const SOCKET_COOLDOWN_MS = 10 * 60 * 1000
+
+/**
+ * Socket alert types that map to vulnerability findings, with a fallback
+ * description for the types whose alerts carry no advisory title (notably
+ * potentialVulnerability, Socket's pending-review signal, which has no
+ * GHSA/CVE/title at all). Fallback text mirrors Socket's own alert-type
+ * descriptions (https://api.socket.dev/v0/alert-types).
+ */
+const VULNERABILITY_ALERT_DESCRIPTIONS: Record<string, string> = {
+  criticalCVE: 'Contains a critical CVE',
+  cve: 'Contains a high severity CVE',
+  mediumCVE: 'Contains a medium severity CVE',
+  mildCVE: 'Contains a low severity CVE',
+  potentialVulnerability:
+    'Socket review suggests a possible vulnerability in this package, pending further analysis',
+}
+
+/**
+ * Curated allowlist of Socket supply-chain alert types surfaced by npmx.
+ * Deliberately conservative: only high-signal, consumer-relevant risks.
+ * npmx queries Socket policy-neutrally (no `actions` filter) and applies
+ * this allowlist itself.
+ */
+const SUPPLY_CHAIN_ALERT_TYPES = new Set<SupplyChainAlertType>([
+  'malware',
+  'gptMalware',
+  'didYouMean',
+  'gptDidYouMean',
+  'troll',
+  'obfuscatedFile',
+  'manifestConfusion',
+  'installScripts',
+  'telemetry',
+  'unstableOwnership',
+])
+
+interface SocketAlert {
+  key?: string
+  type?: string
+  severity?: string
+  category?: string
+  props?: Record<string, unknown>
+}
+
+interface SocketArtifact {
+  type?: string
+  name?: string
+  namespace?: string
+  version?: string
+  alerts?: SocketAlert[]
+  alertKeysToReachabilityTypes?: Record<string, string[]>
+}
+
+/** A vulnerability finding from Socket, normalized for merging with OSV data */
+export interface SocketVulnerabilityFinding {
+  /** Best available identifier: GHSA id, CVE id, or a synthetic socket id */
+  id: string
+  ghsaId?: string
+  cveId?: string
+  summary: string
+  severity: OsvSeverityLevel
+  fixedIn?: string
+  reachability?: VulnerabilityReachability
+  url: string
+}
+
+/** Result of scanning a dependency tree via the Socket batch purl API */
+export interface SocketTreeScan {
+  status: SecuritySourceStatus
+  /** `name@version` -> vulnerability findings */
+  vulnerabilities: Map<string, SocketVulnerabilityFinding[]>
+  /** `name@version` -> supply-chain alerts */
+  supplyChainAlerts: Map<string, SupplyChainAlert[]>
+}
+
+function emptyScan(status: SecuritySourceStatus): SocketTreeScan {
+  return { status, vulnerabilities: new Map(), supplyChainAlerts: new Map() }
+}
+
+function getSocketConfig(): { apiKey: string; orgSlug: string } | null {
+  const { socket } = useRuntimeConfig()
+  if (!socket?.apiKey || !socket?.orgSlug) return null
+  return { apiKey: socket.apiKey, orgSlug: socket.orgSlug }
+}
+
+/** Circuit breaker state: timestamp until which Socket calls are suspended */
+let socketUnavailableUntil = 0
+
+/** Build a package-url for an npm package (scopes are percent-encoded) */
+export function toNpmPurl(name: string, version: string): string {
+  if (name.startsWith('@')) {
+    const slashIndex = name.indexOf('/')
+    const scope = name.slice(0, slashIndex)
+    const base = name.slice(slashIndex + 1)
+    return `pkg:npm/${encodeURIComponent(scope)}/${base}@${version}`
+  }
+  return `pkg:npm/${name}@${version}`
+}
+
+/** Map a Socket severity string onto the shared severity scale */
+function normalizeSocketSeverity(severity: string | undefined): OsvSeverityLevel {
+  switch (severity) {
+    case 'critical':
+      return 'critical'
+    case 'high':
+      return 'high'
+    // the Socket API schema has used both spellings
+    case 'medium':
+    case 'middle':
+      return 'moderate'
+    case 'low':
+      return 'low'
+    default:
+      return 'unknown'
+  }
+}
+
+function normalizeReachability(value: unknown): VulnerabilityReachability | undefined {
+  if (value === 'reachable' || value === 'maybe_reachable' || value === 'unreachable') {
+    return value
+  }
+  if (value === 'maybeReachable') return 'maybe_reachable'
+  return undefined
+}
+
+/** Strongest verdict wins: reachable > maybe_reachable > unreachable */
+const REACHABILITY_PRIORITY: VulnerabilityReachability[] = [
+  'reachable',
+  'maybe_reachable',
+  'unreachable',
+]
+
+/** Pick the stronger (more alarming) of two reachability verdicts */
+export function strongerReachability(
+  a: VulnerabilityReachability | undefined,
+  b: VulnerabilityReachability | undefined,
+): VulnerabilityReachability | undefined {
+  if (!a) return b
+  if (!b) return a
+  return REACHABILITY_PRIORITY.indexOf(a) <= REACHABILITY_PRIORITY.indexOf(b) ? a : b
+}
+
+function extractReachability(
+  alert: SocketAlert,
+  artifact: SocketArtifact,
+): VulnerabilityReachability | undefined {
+  const direct = normalizeReachability(alert.props?.reachability)
+  if (direct) return direct
+
+  const keyed = alert.key ? artifact.alertKeysToReachabilityTypes?.[alert.key] : undefined
+  if (Array.isArray(keyed)) {
+    const normalized = new Set(
+      keyed
+        .map(entry => normalizeReachability(entry))
+        .filter((entry): entry is VulnerabilityReachability => entry !== undefined),
+    )
+    for (const level of REACHABILITY_PRIORITY) {
+      if (normalized.has(level)) return level
+    }
+  }
+
+  return undefined
+}
+
+function artifactPackageName(artifact: SocketArtifact): string | null {
+  if (!artifact.name) return null
+  if (!artifact.namespace) return artifact.name
+  const scope = artifact.namespace.startsWith('@') ? artifact.namespace : `@${artifact.namespace}`
+  return `${scope}/${artifact.name}`
+}
+
+/** Return the value when it is a non-empty string, else undefined */
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value ? value : undefined
+}
+
+function toVulnerabilityFinding(
+  alert: SocketAlert,
+  artifact: SocketArtifact,
+  packageName: string,
+): SocketVulnerabilityFinding {
+  const props = alert.props ?? {}
+  const ghsaId = nonEmptyString(props.ghsaId)
+  const cveId = nonEmptyString(props.cveId)
+  const id = ghsaId ?? cveId ?? `SOCKET-${alert.key ?? alert.type ?? 'unknown'}`
+
+  let url = getSocketPackageUrl(packageName)
+  if (ghsaId) url = `https://github.com/advisories/${ghsaId}`
+  else if (cveId) url = `https://nvd.nist.gov/vuln/detail/${cveId}`
+
+  return {
+    id,
+    ghsaId,
+    cveId,
+    summary:
+      nonEmptyString(props.title) ??
+      (alert.type ? VULNERABILITY_ALERT_DESCRIPTIONS[alert.type] : undefined) ??
+      'No description available',
+    severity: normalizeSocketSeverity(alert.severity),
+    fixedIn: nonEmptyString(props.firstPatchedVersionIdentifier),
+    reachability: extractReachability(alert, artifact),
+    url,
+  }
+}
+
+function isSupplyChainAlertType(type: string | undefined): type is SupplyChainAlertType {
+  return !!type && SUPPLY_CHAIN_ALERT_TYPES.has(type as SupplyChainAlertType)
+}
+
+/** Parse a batch purl response body: ndjson lines or a JSON array */
+function parseArtifacts(raw: unknown): SocketArtifact[] {
+  if (Array.isArray(raw)) return raw as SocketArtifact[]
+  if (raw && typeof raw === 'object') return [raw as SocketArtifact]
+  if (typeof raw !== 'string' || !raw.trim()) return []
+
+  const text = raw.trim()
+  if (text.startsWith('[')) {
+    try {
+      const parsed = JSON.parse(text)
+      return Array.isArray(parsed) ? parsed : []
+    } catch {
+      return []
+    }
+  }
+
+  const artifacts: SocketArtifact[] = []
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed) continue
+    try {
+      artifacts.push(JSON.parse(trimmed))
+    } catch {
+      // skip a malformed/truncated ndjson line rather than discarding the
+      // whole chunk's already-parsed artifacts (up to 1024 packages)
+    }
+  }
+  return artifacts
+}
+
+function isQuotaOrAuthError(error: unknown): boolean {
+  const { status, statusCode } = (error ?? {}) as { status?: number; statusCode?: number }
+  const code = status ?? statusCode
+  return code === 429 || code === 403
+}
+
+interface PackageRef {
+  name: string
+  version: string
+}
+
+/** Vulnerability + supply-chain findings for a single package@version */
+interface PurlFindings {
+  vulnerabilities: SocketVulnerabilityFinding[]
+  supplyChainAlerts: SupplyChainAlert[]
+}
+
+interface CachedPurlEntry {
+  findings: PurlFindings
+  storedAt: number
+}
+
+/** Split a tree into cached per-purl findings and the purls still to fetch.
+ * A cache-storage outage must not fail the scan, so it degrades to all-misses
+ * (Socket is queried directly) rather than propagating the error. */
+async function readPurlCache(
+  packages: PackageRef[],
+): Promise<{ hits: Map<string, PurlFindings>; misses: PackageRef[] }> {
+  const hits = new Map<string, PurlFindings>()
+  let entries: Array<{ value: unknown }>
+  try {
+    entries = await useStorage('cache').getItems(
+      packages.map(pkg => SOCKET_PURL_CACHE_PREFIX + `${pkg.name}@${pkg.version}`),
+    )
+  } catch (error) {
+    // oxlint-disable-next-line no-console -- log cache read failures for debugging
+    console.warn('[socket] purl cache read failed, treating every purl as a miss:', error)
+    return { hits, misses: [...packages] }
+  }
+
+  const misses: PackageRef[] = []
+  const now = Date.now()
+  entries.forEach((entry, i) => {
+    const pkg = packages[i]!
+    const cached = entry.value as CachedPurlEntry | null
+    if (cached && now - cached.storedAt < SOCKET_PURL_CACHE_TTL_MS) {
+      hits.set(`${pkg.name}@${pkg.version}`, cached.findings)
+    } else {
+      misses.push(pkg)
+    }
+  })
+  return { hits, misses }
+}
+
+/** Persist freshly-fetched findings, including the empty results for
+ * alert-free packages so they are not re-queried on the next tree. A write
+ * failure is swallowed so it can't discard findings already normalized. */
+async function writePurlCache(findings: Map<string, PurlFindings>): Promise<void> {
+  const storedAt = Date.now()
+  try {
+    await useStorage('cache').setItems(
+      Array.from(findings, ([key, value]) => {
+        const entry: CachedPurlEntry = { findings: value, storedAt }
+        return { key: SOCKET_PURL_CACHE_PREFIX + key, value: entry }
+      }),
+    )
+  } catch (error) {
+    // oxlint-disable-next-line no-console -- log cache write failures for debugging
+    console.warn('[socket] purl cache write failed:', error)
+  }
+}
+
+/** Accumulate normalized findings from parsed artifacts into a per-purl map */
+function collectFindings(artifacts: SocketArtifact[], into: Map<string, PurlFindings>): void {
+  for (const artifact of artifacts) {
+    const name = artifactPackageName(artifact)
+    if (!name || !artifact.version || !artifact.alerts?.length) continue
+    const key = `${name}@${artifact.version}`
+    const entry = into.get(key) ?? { vulnerabilities: [], supplyChainAlerts: [] }
+
+    for (const alert of artifact.alerts) {
+      if (alert.type && Object.hasOwn(VULNERABILITY_ALERT_DESCRIPTIONS, alert.type)) {
+        entry.vulnerabilities.push(toVulnerabilityFinding(alert, artifact, name))
+      } else if (isSupplyChainAlertType(alert.type)) {
+        // The same alert type can fire for multiple files; surface it once
+        if (!entry.supplyChainAlerts.some(existing => existing.type === alert.type)) {
+          entry.supplyChainAlerts.push({
+            type: alert.type,
+            severity: normalizeSocketSeverity(alert.severity),
+            url: getSocketPackageUrl(name),
+            sources: ['socket'],
+          })
+        }
+      }
+    }
+    into.set(key, entry)
+  }
+}
+
+function applyFindings(scan: SocketTreeScan, key: string, findings: PurlFindings): void {
+  if (findings.vulnerabilities.length) scan.vulnerabilities.set(key, findings.vulnerabilities)
+  if (findings.supplyChainAlerts.length) scan.supplyChainAlerts.set(key, findings.supplyChainAlerts)
+}
+
+/**
+ * Query the Socket batch purl API for a dependency tree and normalize the
+ * results, caching per package@version (see SOCKET_PURL_CACHE_TTL_MS) so that
+ * overlapping and revisited trees reuse findings and only never-before-seen
+ * versions cost an API request.
+ *
+ * Policy-neutral: no `actions` filter is sent; npmx curates alert types via
+ * its own allowlists. Degrades gracefully: `unconfigured` without an API key,
+ * `unavailable` while the quota circuit breaker is open, `failed`/`partial`
+ * on request errors.
+ *
+ * @see https://docs.socket.dev/reference/batchpackagefetchbyorg
+ */
+export async function querySocketForTree(packages: PackageRef[]): Promise<SocketTreeScan> {
+  const config = getSocketConfig()
+  if (!config) return emptyScan('unconfigured')
+  if (packages.length === 0) return emptyScan('ok')
+
+  const { hits, misses } = await readPurlCache(packages)
+  const scan = emptyScan('ok')
+  for (const [key, findings] of hits) applyFindings(scan, key, findings)
+
+  if (misses.length === 0) return scan
+  if (Date.now() < socketUnavailableUntil) {
+    // cached findings still stand, but the misses can't be refreshed right now
+    scan.status = hits.size > 0 ? 'partial' : 'unavailable'
+    return scan
+  }
+
+  const fetched = new Map<string, PurlFindings>()
+  let succeededChunks = 0
+  let quotaExhausted = false
+
+  const chunks: PackageRef[][] = []
+  for (let i = 0; i < misses.length; i += SOCKET_PURL_BATCH_LIMIT) {
+    chunks.push(misses.slice(i, i + SOCKET_PURL_BATCH_LIMIT))
+  }
+
+  for (const chunk of chunks) {
+    try {
+      const raw = await $fetch(
+        `https://api.socket.dev/v0/orgs/${encodeURIComponent(config.orgSlug)}/purl?alerts=true`,
+        {
+          method: 'POST',
+          timeout: SOCKET_FETCH_TIMEOUT_MS,
+          headers: {
+            authorization: `Bearer ${config.apiKey}`,
+            accept: 'application/x-ndjson',
+          },
+          // no compact=true: compact responses strip alert props (ghsaId,
+          // cveId, title, reachability), which merging and the UI depend on
+          body: {
+            components: chunk.map(pkg => ({ purl: toNpmPurl(pkg.name, pkg.version) })),
+          },
+          responseType: 'text',
+        },
+      )
+
+      // seed every requested purl so alert-free packages are cached too (and
+      // therefore skipped next time), then fill in whatever the response held
+      const chunkFindings = new Map<string, PurlFindings>()
+      for (const pkg of chunk) {
+        chunkFindings.set(`${pkg.name}@${pkg.version}`, {
+          vulnerabilities: [],
+          supplyChainAlerts: [],
+        })
+      }
+      collectFindings(parseArtifacts(raw), chunkFindings)
+      for (const [key, findings] of chunkFindings) {
+        fetched.set(key, findings)
+        applyFindings(scan, key, findings)
+      }
+
+      succeededChunks++
+    } catch (error) {
+      if (isQuotaOrAuthError(error)) {
+        quotaExhausted = true
+        socketUnavailableUntil = Date.now() + SOCKET_COOLDOWN_MS
+        // oxlint-disable-next-line no-console -- log Socket quota exhaustion
+        console.warn('[socket] quota/authorization error, suspending Socket queries:', error)
+        break
+      }
+      // oxlint-disable-next-line no-console -- log Socket API failures for debugging
+      console.warn('[socket] batch purl query failed:', error)
+    }
+  }
+
+  if (fetched.size > 0) await writePurlCache(fetched)
+
+  if (succeededChunks === chunks.length) {
+    scan.status = 'ok'
+  } else if (succeededChunks > 0 || hits.size > 0) {
+    scan.status = 'partial'
+  } else {
+    scan.status = quotaExhausted ? 'unavailable' : 'failed'
+  }
+  return scan
+}
diff --git a/shared/types/comparison.ts b/shared/types/comparison.ts
index bedcda8d33..6017d9c11e 100644
--- a/shared/types/comparison.ts
+++ b/shared/types/comparison.ts
@@ -11,6 +11,7 @@ export type ComparisonFacet =
   | 'types'
   | 'engines'
   | 'vulnerabilities'
+  | 'supplyChainAlerts'
   | 'lastUpdated'
   | 'license'
   | 'dependencies'
@@ -89,6 +90,9 @@ export const FACET_INFO: Record<ComparisonFacet, Omit<FacetInfo, 'id'>> = {
   vulnerabilities: {
     category: 'security',
   },
+  supplyChainAlerts: {
+    category: 'security',
+  },
 }
 
 /** All facets in display order */
diff --git a/shared/types/dependency-analysis.ts b/shared/types/dependency-analysis.ts
index a733c302e5..c2ae0499cd 100644
--- a/shared/types/dependency-analysis.ts
+++ b/shared/types/dependency-analysis.ts
@@ -5,6 +5,29 @@
  * @see https://google.github.io/osv.dev/api/
  */
 
+/**
+ * Identifier for a security data source that can report vulnerabilities
+ */
+export type SecuritySourceId = 'osv' | 'socket'
+
+/**
+ * Fetch status for a single security data source:
+ * - `ok`: all queries succeeded
+ * - `partial`: some queries failed; results may be incomplete
+ * - `failed`: the source could not be queried at all
+ * - `unconfigured`: the source needs server-side configuration (e.g. an API
+ *   key) that this deployment does not have
+ * - `unavailable`: the source is configured but temporarily out of service
+ *   (e.g. quota exhausted)
+ */
+export type SecuritySourceStatus = 'ok' | 'partial' | 'failed' | 'unconfigured' | 'unavailable'
+
+/**
+ * Socket reachability analysis verdict for a vulnerability: whether the
+ * vulnerable code is actually reachable from the package's entry points
+ */
+export type VulnerabilityReachability = 'reachable' | 'maybe_reachable' | 'unreachable'
+
 /**
  * Severity levels in priority order (highest first)
  */
@@ -128,9 +151,68 @@ export interface VulnerabilitySummary {
   summary: string
   severity: OsvSeverityLevel
   aliases: string[]
+  /**
+   * CVE id paired one-to-one with this advisory by a source's own record.
+   * Alias lists can span multiple distinct advisories (e.g. OSV expands
+   * aliases to the whole alias group), so this is the only trustworthy
+   * GHSA-to-CVE pairing when `aliases` contains several CVEs.
+   */
+  cveId?: string
+  /**
+   * Ids the source listed as aliases of this advisory but that provably
+   * belong to a sibling advisory (upstream alias-group pollution). Removed
+   * from `aliases`; kept here so the UI can attribute the bad data to the
+   * source that supplied it.
+   */
+  disputedAliases?: string[]
   url: string
   /** Version that fixes this vulnerability (if known) */
   fixedIn?: string
+  /** Security data sources that reported this vulnerability */
+  sources: SecuritySourceId[]
+  /** Socket reachability analysis verdict, when available */
+  reachability?: VulnerabilityReachability
+}
+
+/**
+ * Socket supply-chain alert types surfaced by npmx (curated subset)
+ */
+export type SupplyChainAlertType =
+  | 'malware'
+  | 'gptMalware'
+  | 'didYouMean'
+  | 'gptDidYouMean'
+  | 'troll'
+  | 'obfuscatedFile'
+  | 'manifestConfusion'
+  | 'installScripts'
+  | 'telemetry'
+  | 'unstableOwnership'
+
+/**
+ * A single supply-chain risk alert for a package
+ */
+export interface SupplyChainAlert {
+  /** Alert type key (curated subset of Socket alert types) */
+  type: SupplyChainAlertType
+  severity: OsvSeverityLevel
+  /** URL with more detail (socket.dev package page) */
+  url: string
+  /** Security data sources that reported this alert */
+  sources: SecuritySourceId[]
+}
+
+/**
+ * Supply-chain alerts for a single package in the tree
+ */
+export interface PackageSupplyChainInfo {
+  name: string
+  version: string
+  /** Depth in dependency tree: root (0), direct (1), transitive (2+) */
+  depth: DependencyDepth
+  /** Dependency path from root package */
+  path: string[]
+  alerts: SupplyChainAlert[]
 }
 
 /**
@@ -190,12 +272,16 @@ export interface VulnerabilityTreeResult {
   version: string
   /** All packages with vulnerabilities in the tree */
   vulnerablePackages: PackageVulnerabilityInfo[]
+  /** All packages with supply-chain alerts in the tree */
+  supplyChainPackages: PackageSupplyChainInfo[]
   /** All deprecated packages in the tree */
   deprecatedPackages: DeprecatedPackageInfo[]
   /** Total packages analyzed */
   totalPackages: number
   /** Number of packages that could not be checked (OSV query failed) */
   failedQueries: number
+  /** Per-source fetch status for the security data sources that were queried */
+  sourceStatus: Record<SecuritySourceId, SecuritySourceStatus>
   /** Aggregated counts across all packages */
   totalCounts: {
     total: number
diff --git a/shared/utils/security-sources.ts b/shared/utils/security-sources.ts
new file mode 100644
index 0000000000..d2752addee
--- /dev/null
+++ b/shared/utils/security-sources.ts
@@ -0,0 +1,149 @@
+import type {
+  PackageVulnerabilityInfo,
+  SecuritySourceId,
+  SecuritySourceStatus,
+  VulnerabilitySummary,
+  VulnerabilityTreeResult,
+} from '../types/dependency-analysis'
+import { SEVERITY_LEVELS } from '../types/dependency-analysis'
+
+/** All known security data sources, in display order */
+export const SECURITY_SOURCE_IDS = ['osv', 'socket'] as const satisfies readonly SecuritySourceId[]
+
+/** socket.dev package page for a given npm package (also the attribution link) */
+export function getSocketPackageUrl(packageName: string): string {
+  return `https://socket.dev/npm/package/${packageName}`
+}
+
+/**
+ * Whether none of the user's enabled security data sources produced any
+ * data, meaning the displayed (source-filtered) result carries no
+ * vulnerability information at all. Sources that failed, are unconfigured,
+ * or are temporarily unavailable carry no data; a source only counts as
+ * informative if it succeeded (fully or partially) AND the user has it
+ * enabled - an 'ok' status from a disabled source must not mask a failure
+ * of the only enabled one. Callers should treat an uninformative result as
+ * "could not check" rather than "no vulnerabilities". Returns `false` when
+ * no source is enabled at all; callers handle the nothing-enabled state
+ * separately.
+ */
+export function noEnabledSecuritySourceHasData(
+  sourceStatus: Partial<Record<SecuritySourceId, SecuritySourceStatus>>,
+  enabledSources: Partial<Record<SecuritySourceId, boolean>>,
+): boolean {
+  const relevant = Object.entries(sourceStatus).filter(
+    ([source]) => enabledSources[source as SecuritySourceId],
+  )
+  return (
+    relevant.length > 0 && !relevant.some(([, status]) => status === 'ok' || status === 'partial')
+  )
+}
+
+/**
+ * Whether a specific source actually produced data (fully or partially).
+ * A source that is unconfigured, unavailable, or failed carries no data, so
+ * its findings (e.g. Socket-only supply-chain alerts) must render as
+ * "could not check" rather than a reassuring zero.
+ */
+export function securitySourceHasData(
+  sourceStatus: Partial<Record<SecuritySourceId, SecuritySourceStatus>>,
+  source: SecuritySourceId,
+): boolean {
+  const status = sourceStatus[source]
+  return status === 'ok' || status === 'partial'
+}
+
+/**
+ * Whether any source failed for a (possibly transient) reason - an outage,
+ * quota exhaustion, or a partially-completed scan. Used to cache such results
+ * for a much shorter time than complete ones, so a blip doesn't strip
+ * findings from caches for an hour. `unconfigured` is deliberately excluded:
+ * it is a stable deployment state.
+ */
+export function hasTransientSourceFailure(
+  sourceStatus: Partial<Record<SecuritySourceId, SecuritySourceStatus>>,
+): boolean {
+  return Object.values(sourceStatus).some(
+    status => status === 'failed' || status === 'unavailable' || status === 'partial',
+  )
+}
+
+/**
+ * Pick the findings for a collapsed preview. Severity order is kept, but
+ * every source that reported a finding is guaranteed a representative
+ * (a merged finding represents all of its sources), so a short preview
+ * cannot read as "only one source found problems".
+ */
+export function selectPreviewVulnerabilities(
+  vulnerabilities: VulnerabilitySummary[],
+  limit: number,
+): VulnerabilitySummary[] {
+  if (vulnerabilities.length <= limit) return vulnerabilities
+
+  const picked = new Set<VulnerabilitySummary>()
+  const uncovered = new Set(vulnerabilities.flatMap(vuln => vuln.sources))
+  for (const vuln of vulnerabilities) {
+    if (picked.size >= limit) break
+    if (vuln.sources.some(source => uncovered.has(source))) {
+      picked.add(vuln)
+      for (const source of vuln.sources) uncovered.delete(source)
+    }
+  }
+  for (const vuln of vulnerabilities) {
+    if (picked.size >= limit) break
+    picked.add(vuln)
+  }
+  return vulnerabilities.filter(vuln => picked.has(vuln))
+}
+
+/** Count vulnerabilities by severity level ('unknown' contributes only to the total) */
+export function countBySeverity(
+  vulnerabilities: PackageVulnerabilityInfo['vulnerabilities'],
+): PackageVulnerabilityInfo['counts'] {
+  const counts = { total: vulnerabilities.length, critical: 0, high: 0, moderate: 0, low: 0 }
+  for (const vuln of vulnerabilities) {
+    if (vuln.severity !== 'unknown') counts[vuln.severity]++
+  }
+  return counts
+}
+
+/**
+ * Filter a vulnerability tree down to findings reported by at least one
+ * enabled security data source, recomputing per-package and total counts.
+ * This is a pure display filter: deprecated packages and scan metadata are
+ * passed through unchanged.
+ */
+export function filterVulnerabilityTreeBySources(
+  tree: VulnerabilityTreeResult,
+  enabledSources: Partial<Record<SecuritySourceId, boolean>>,
+): VulnerabilityTreeResult {
+  const vulnerablePackages = tree.vulnerablePackages
+    .map(pkg => {
+      const vulnerabilities = pkg.vulnerabilities.filter(vuln =>
+        vuln.sources.some(source => enabledSources[source]),
+      )
+      if (vulnerabilities.length === pkg.vulnerabilities.length) return pkg
+      return { ...pkg, vulnerabilities, counts: countBySeverity(vulnerabilities) }
+    })
+    .filter(pkg => pkg.vulnerabilities.length > 0)
+
+  const totalCounts = { total: 0, critical: 0, high: 0, moderate: 0, low: 0 }
+  for (const pkg of vulnerablePackages) {
+    totalCounts.total += pkg.counts.total
+    for (const severity of SEVERITY_LEVELS) {
+      totalCounts[severity] += pkg.counts[severity]
+    }
+  }
+
+  const supplyChainPackages = tree.supplyChainPackages
+    .map(pkg => {
+      const alerts = pkg.alerts.filter(alert =>
+        alert.sources.some(source => enabledSources[source]),
+      )
+      if (alerts.length === pkg.alerts.length) return pkg
+      return { ...pkg, alerts }
+    })
+    .filter(pkg => pkg.alerts.length > 0)
+
+  return { ...tree, vulnerablePackages, supplyChainPackages, totalCounts }
+}
diff --git a/test/e2e/hydration.spec.ts b/test/e2e/hydration.spec.ts
index bdf32f4714..31e6f1ee19 100644
--- a/test/e2e/hydration.spec.ts
+++ b/test/e2e/hydration.spec.ts
@@ -156,6 +156,20 @@ test.describe('Hydration', () => {
 
     expect(hydrationErrors).toEqual([])
   })
+
+  test('package page with all security sources disabled', async ({
+    page,
+    goto,
+    hydrationErrors,
+  }) => {
+    await injectLocalStorage(page, {
+      'npmx-settings': JSON.stringify({ securitySources: { osv: false } }),
+    })
+
+    await goto('/package/nuxt', { waitUntil: 'hydration' })
+
+    expect(hydrationErrors).toEqual([])
+  })
 })
 
 async function injectLocalStorage(page: Page, entries: Record<string, string>) {
diff --git a/test/e2e/vulnerabilities.spec.ts b/test/e2e/vulnerabilities.spec.ts
index f39172b938..221ce01175 100644
--- a/test/e2e/vulnerabilities.spec.ts
+++ b/test/e2e/vulnerabilities.spec.ts
@@ -24,6 +24,7 @@ test.describe('vulnerabilities API', () => {
     expect(body).toHaveProperty('package', 'vue')
     expect(body).toHaveProperty('version')
     expect(body).toHaveProperty('totalCounts')
+    expect(body).toHaveProperty('sourceStatus.osv')
   })
 
   test('scoped package vulnerabilities with URL encoding', async ({ page, baseURL }) => {
@@ -75,4 +76,52 @@ test.describe('vulnerabilities API', () => {
 
     expect(response.status()).toBe(404) // Package not found returns 404
   })
+
+  // The fixture layer (modules/runtime/server/cache.ts) fabricates findings
+  // for is-odd from both OSV and Socket, exercising the merged two-source path
+  test('merges OSV and Socket findings for the security fixture package', async ({
+    page,
+    baseURL,
+  }) => {
+    const url = toLocalUrl(baseURL, '/api/registry/vulnerabilities/is-odd')
+    const { response, body } = await fetchVulnerabilities(page, url)
+
+    expect(response.status()).toBe(200)
+    expect(body.sourceStatus).toEqual({ osv: 'ok', socket: 'ok' })
+
+    const fixturePkg = body.vulnerablePackages.find(
+      (pkg: { name: string }) => pkg.name === 'is-odd',
+    )
+    expect(fixturePkg).toBeDefined()
+
+    // Reported by both sources: merged into one entry, tagged with both
+    const shared = fixturePkg.vulnerabilities.find(
+      (vuln: { id: string }) => vuln.id === 'GHSA-npmx-test-0001',
+    )
+    expect(shared).toBeDefined()
+    expect(shared.sources).toEqual(expect.arrayContaining(['osv', 'socket']))
+    expect(shared.sources).toHaveLength(2)
+    expect(shared.reachability).toBe('reachable')
+    expect(shared.cveId).toBe('CVE-2024-00001')
+
+    // Reported only by Socket
+    const socketOnly = fixturePkg.vulnerabilities.find(
+      (vuln: { id: string }) => vuln.id === 'GHSA-npmx-test-0002',
+    )
+    expect(socketOnly).toBeDefined()
+    expect(socketOnly.sources).toEqual(['socket'])
+    expect(socketOnly.reachability).toBe('unreachable')
+
+    // Counts include both sources, deduplicated
+    expect(fixturePkg.counts.total).toBe(2)
+
+    // Supply-chain alerts from Socket's curated allowlist
+    const supplyChainPkg = body.supplyChainPackages.find(
+      (pkg: { name: string }) => pkg.name === 'is-odd',
+    )
+    expect(supplyChainPkg).toBeDefined()
+    expect(supplyChainPkg.alerts).toEqual([
+      expect.objectContaining({ type: 'troll', sources: ['socket'] }),
+    ])
+  })
 })
diff --git a/test/nuxt/a11y.spec.ts b/test/nuxt/a11y.spec.ts
index 24cc1df740..6c2c0bb0e4 100644
--- a/test/nuxt/a11y.spec.ts
+++ b/test/nuxt/a11y.spec.ts
@@ -237,6 +237,7 @@ import {
   PackageTimelineChartXyTooltip,
   PackageTimelineChartXySvgSlot,
   PackageVersions,
+  PackageSupplyChainAlerts,
   PackageVulnerabilityTree,
   PaginationControls,
   ProgressBar,
@@ -244,12 +245,16 @@ import {
   Readme,
   ReadmeTocDropdown,
   SearchProviderToggle,
+  SecuritySourceToggle,
+  SecuritySourcesWarning,
+  SecuritySourceLogo,
   SearchSuggestionCard,
   SelectBase,
   SelectField,
   SettingsAccentColorPicker,
   SettingsBgThemePicker,
   SettingsFgThemePicker,
+  SettingsSwitch,
   SettingsToggle,
   TagStatic,
   TagRadioButton,
@@ -290,6 +295,7 @@ import CommandPaletteComponent from '~/components/CommandPalette.client.vue'
 import HeaderAccountMenuServer from '~/components/Header/AccountMenu.server.vue'
 import ToggleServer from '~/components/Settings/Toggle.server.vue'
 import SearchProviderToggleServer from '~/components/SearchProviderToggle.server.vue'
+import SecuritySourceToggleServer from '~/components/SecuritySourceToggle.server.vue'
 import PackageTrendsChart from '~/components/Package/TrendsChart.vue'
 import FacetBarChart from '~/components/Compare/FacetBarChart.vue'
 import FacetScatterChart from '~/components/Compare/FacetScatterChart.vue'
@@ -2565,6 +2571,19 @@ describe('component accessibility audits', () => {
     })
   })
 
+  describe('PackageSupplyChainAlerts', () => {
+    it('should have no accessibility violations in idle state', async () => {
+      const component = await mountSuspended(PackageSupplyChainAlerts, {
+        props: {
+          packageName: 'vue',
+          version: '3.5.0',
+        },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
   describe('DependencyPathPopup', () => {
     it('should have no accessibility violations with short path', async () => {
       const component = await mountSuspended(DependencyPathPopup, {
@@ -3647,6 +3666,38 @@ describe('component accessibility audits', () => {
     })
   })
 
+  describe('SecuritySourceToggle', () => {
+    it('should have no accessibility violations', async () => {
+      const component = await mountSuspended(SecuritySourceToggle)
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
+  describe('SecuritySourceToggle.server', () => {
+    it('should have no accessibility violations', async () => {
+      const component = await mountSuspended(SecuritySourceToggleServer)
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
+  describe('SecuritySourcesWarning', () => {
+    it('should have no accessibility violations', async () => {
+      const component = await mountSuspended(SecuritySourcesWarning)
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
+  describe('SecuritySourceLogo', () => {
+    it('should have no accessibility violations', async () => {
+      const component = await mountSuspended(SecuritySourceLogo, { props: { source: 'socket' } })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
   describe('Toggle.server', () => {
     it('should have no accessibility violations', async () => {
       const component = await mountSuspended(ToggleServer, {
@@ -3698,6 +3749,16 @@ describe('component accessibility audits', () => {
     })
   })
 
+  describe('Switch', () => {
+    it('should have no accessibility violations', async () => {
+      const component = await mountSuspended(SettingsSwitch, {
+        props: { ariaLabel: 'Enable feature', modelValue: false },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
   describe('VersionSelector', () => {
     const mockVersions = {
       '3.5.0': {},
diff --git a/test/nuxt/components/compare/FacetSelector.spec.ts b/test/nuxt/components/compare/FacetSelector.spec.ts
index d90ee51c5a..bc8804b481 100644
--- a/test/nuxt/components/compare/FacetSelector.spec.ts
+++ b/test/nuxt/components/compare/FacetSelector.spec.ts
@@ -23,6 +23,10 @@ const facetLabels: Record<ComparisonFacet, { label: string; description: string
   types: { label: 'Types', description: 'TypeScript type definitions' },
   engines: { label: 'Engines', description: 'Node.js version requirements' },
   vulnerabilities: { label: 'Vulnerabilities', description: 'Known security vulnerabilities' },
+  supplyChainAlerts: {
+    label: 'Supply chain alerts',
+    description: 'Socket supply chain risk alerts',
+  },
   lastUpdated: { label: 'Published', description: 'When this version was published' },
   license: { label: 'License', description: 'Package license' },
   dependencies: { label: 'Direct Deps', description: 'Number of direct dependencies' },
diff --git a/test/nuxt/composables/use-security-sources-available.spec.ts b/test/nuxt/composables/use-security-sources-available.spec.ts
new file mode 100644
index 0000000000..f3e57025c3
--- /dev/null
+++ b/test/nuxt/composables/use-security-sources-available.spec.ts
@@ -0,0 +1,38 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// The sibling use-settings.spec.ts covers the key-less (unavailable) branch via
+// the real runtime config; here we flip public.socketConfigured on to exercise
+// the available branch, restoring it afterwards so the change can't leak.
+describe('useSecuritySources - available Socket deployment', () => {
+  let previous: boolean
+  // test/nuxt runs in a real browser, so localStorage persists across tests -
+  // restore whatever was there so this case can't corrupt another's settings
+  let previousSettings: string | null = null
+
+  beforeEach(() => {
+    vi.resetModules()
+    const runtimeConfig = useRuntimeConfig()
+    previous = runtimeConfig.public.socketConfigured
+    runtimeConfig.public.socketConfigured = true
+    previousSettings = localStorage.getItem('npmx-settings')
+    localStorage.removeItem('npmx-settings')
+  })
+
+  afterEach(() => {
+    useRuntimeConfig().public.socketConfigured = previous
+    if (previousSettings === null) {
+      localStorage.removeItem('npmx-settings')
+    } else {
+      localStorage.setItem('npmx-settings', previousSettings)
+    }
+  })
+
+  it('treats Socket as available and effective when the deployment has a key', async () => {
+    const { useSecuritySources } = await import('~/composables/useSettings')
+    const { sourceAvailability, effectiveSources } = useSecuritySources()
+
+    expect(sourceAvailability.value.socket).toBe(true)
+    // the default preference has Socket on, so an available deployment surfaces it
+    expect(effectiveSources.value.socket).toBe(true)
+  })
+})
diff --git a/test/nuxt/composables/use-settings.spec.ts b/test/nuxt/composables/use-settings.spec.ts
index 74eb043450..4d85c680fc 100644
--- a/test/nuxt/composables/use-settings.spec.ts
+++ b/test/nuxt/composables/use-settings.spec.ts
@@ -74,3 +74,80 @@ describe('useSettings - codeLigatures', () => {
     })
   })
 })
+
+describe('useSettings - securitySources', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    // settings persist to real localStorage in browser mode - clear between
+    // tests so mutations from one test don't leak into the next
+    localStorage.removeItem('npmx-settings')
+  })
+
+  it('defaults every security source to enabled', async () => {
+    const { useSettings } = await import('~/composables/useSettings')
+    const { settings } = useSettings()
+    expect(settings.value.securitySources).toEqual({ osv: true, socket: true })
+  })
+
+  it('treats Socket as unavailable when the deployment has no key', async () => {
+    const { useSecuritySources } = await import('~/composables/useSettings')
+    const { sourceAvailability, effectiveSources } = useSecuritySources()
+
+    // test runtime config has no socketConfigured flag set
+    expect(sourceAvailability.value.socket).toBe(false)
+    expect(effectiveSources.value.socket).toBe(false)
+    expect(sourceAvailability.value.osv).toBe(true)
+  })
+
+  describe('useSecuritySources composable', () => {
+    it('setSourceEnabled updates the stored preference', async () => {
+      const { useSettings, useSecuritySources } = await import('~/composables/useSettings')
+      const { settings } = useSettings()
+      const { setSourceEnabled } = useSecuritySources()
+
+      setSourceEnabled('osv', false)
+      expect(settings.value.securitySources.osv).toBe(false)
+
+      setSourceEnabled('osv', true)
+      expect(settings.value.securitySources.osv).toBe(true)
+    })
+
+    it('returns defaults before mount (SSR/hydration safety)', async () => {
+      const { useSettings, useSecuritySources } = await import('~/composables/useSettings')
+      const { settings } = useSettings()
+      const { enabledSources, anySourceEnabled } = useSecuritySources()
+
+      // Outside a mounted component, the useMounted() guard keeps the
+      // defaults so the first client render matches the server render
+      settings.value.securitySources.osv = false
+      expect(enabledSources.value.osv).toBe(true)
+      expect(anySourceEnabled.value).toBe(true)
+    })
+
+    it('reflects preference changes once mounted', async () => {
+      const { mountSuspended } = await import('@nuxt/test-utils/runtime')
+      const { defineComponent, nextTick } = await import('vue')
+      const { useSettings, useSecuritySources } = await import('~/composables/useSettings')
+
+      const wrapper = await mountSuspended(
+        defineComponent({
+          setup() {
+            const { anySourceEnabled } = useSecuritySources()
+            return { anySourceEnabled }
+          },
+          template: '<div>{{ anySourceEnabled }}</div>',
+        }),
+      )
+
+      const { settings } = useSettings()
+
+      settings.value.securitySources.osv = true
+      await nextTick()
+      expect(wrapper.text()).toBe('true')
+
+      settings.value.securitySources.osv = false
+      await nextTick()
+      expect(wrapper.text()).toBe('false')
+    })
+  })
+})
diff --git a/test/unit/server/utils/dependency-analysis.spec.ts b/test/unit/server/utils/dependency-analysis.spec.ts
index 9fe2b17850..511f7cd5c8 100644
--- a/test/unit/server/utils/dependency-analysis.spec.ts
+++ b/test/unit/server/utils/dependency-analysis.spec.ts
@@ -13,7 +13,26 @@ vi.mock('#server/utils/dependency-resolver', () => ({
   resolveDependencyTree: vi.fn(),
 }))
 
+// Mock the Socket client's HTTP layer (covered by socket.spec.ts) while
+// keeping pure helpers like strongerReachability real
+vi.mock('#server/utils/socket', async importOriginal => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  querySocketForTree: vi.fn(),
+}))
+
 const { resolveDependencyTree } = await import('#server/utils/dependency-resolver')
+const { querySocketForTree } = await import('#server/utils/socket')
+
+type SocketScan = Awaited<ReturnType<typeof querySocketForTree>>
+
+function mockSocketScan(scan: Partial<SocketScan> = {}) {
+  vi.mocked(querySocketForTree).mockResolvedValue({
+    status: 'unconfigured',
+    vulnerabilities: new Map(),
+    supplyChainAlerts: new Map(),
+    ...scan,
+  })
+}
 
 /**
  * Helper to create mock $fetch that handles the two-step OSV API pattern:
@@ -43,6 +62,8 @@ function mockOsvApi(
 describe('dependency-analysis', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    // Default: Socket is not configured (no key), contributing no findings
+    mockSocketScan()
   })
 
   describe('analyzeDependencyTree', () => {
@@ -74,6 +95,7 @@ describe('dependency-analysis', () => {
       expect(result.totalPackages).toBe(1)
       expect(result.failedQueries).toBe(0)
       expect(result.totalCounts).toEqual({ total: 0, critical: 0, high: 0, moderate: 0, low: 0 })
+      expect(result.sourceStatus).toEqual({ osv: 'ok', socket: 'unconfigured' })
     })
 
     it('tracks failed queries when OSV batch API fails', async () => {
@@ -117,6 +139,42 @@ describe('dependency-analysis', () => {
       // When batch fails, all packages are counted as failed
       expect(result.failedQueries).toBe(2)
       expect(result.totalPackages).toBe(2)
+      expect(result.sourceStatus).toEqual({ osv: 'failed', socket: 'unconfigured' })
+    })
+
+    it('reports partial source status when some detail queries fail', async () => {
+      // Suppress expected console output from error path
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+      const mockResolved = new Map([
+        [
+          'test-pkg@1.0.0',
+          {
+            name: 'test-pkg',
+            version: '1.0.0',
+            size: 1000,
+            optional: false,
+            depth: 'root' as const,
+            path: ['test-pkg@1.0.0'],
+            tarballUrl: 'https://example.com/test-pkg-1.0.0.tgz',
+          },
+        ],
+      ])
+      vi.mocked(resolveDependencyTree).mockResolvedValue(mockResolved)
+
+      // Batch succeeds and reports a vulnerable package, but the detail query fails
+      $fetchMock.mockImplementation(async (url: string) => {
+        if (url === 'https://api.osv.dev/v1/querybatch') {
+          return { results: [{ vulns: [{ id: 'GHSA-test', modified: '2024-01-01' }] }] }
+        }
+        throw new Error('OSV detail query failed')
+      })
+
+      const result = await analyzeDependencyTree('test-pkg', '1.0.0')
+
+      expect(result.vulnerablePackages).toHaveLength(0)
+      expect(result.failedQueries).toBe(1)
+      expect(result.sourceStatus).toEqual({ osv: 'partial', socket: 'unconfigured' })
     })
 
     it('correctly counts vulnerabilities by severity', async () => {
@@ -166,6 +224,11 @@ describe('dependency-analysis', () => {
 
       expect(result.vulnerablePackages).toHaveLength(1)
       expect(result.totalCounts).toEqual({ total: 4, critical: 1, high: 1, moderate: 1, low: 1 })
+      expect(result.sourceStatus).toEqual({ osv: 'ok', socket: 'unconfigured' })
+      // Every vulnerability found via OSV is tagged with its source
+      for (const vuln of result.vulnerablePackages[0]!.vulnerabilities) {
+        expect(vuln.sources).toEqual(['osv'])
+      }
 
       const pkg = result.vulnerablePackages[0]
       expect(pkg?.counts.critical).toBe(1)
@@ -678,6 +741,69 @@ describe('dependency-analysis', () => {
       expect(result.vulnerablePackages[0]?.vulnerabilities[0]?.fixedIn).toBe('1.2.3')
     })
 
+    it('handles shorthand semver in range events (e.g. introduced "13.0")', async () => {
+      const mockResolved = new Map([
+        [
+          'next@14.2.5',
+          {
+            name: 'next',
+            version: '14.2.5',
+            size: 1000,
+            optional: false,
+            depth: 'root' as const,
+            path: ['next@14.2.5'],
+            tarballUrl: 'https://example.com/next-14.2.5.tgz',
+          },
+        ],
+      ])
+      vi.mocked(resolveDependencyTree).mockResolvedValue(mockResolved)
+
+      // Mirrors GHSA-3h52-269p-cp9r: OSV publishes the backport range with a
+      // shorthand introduced version ("13.0"), which strict semver rejects
+      mockOsvApi(
+        [{ vulns: [{ id: 'GHSA-3h52-269p-cp9r', modified: '2025-01-01' }] }],
+        new Map([
+          [
+            'next@14.2.5',
+            {
+              vulns: [
+                {
+                  id: 'GHSA-3h52-269p-cp9r',
+                  summary: 'Information exposure in Next.js dev server',
+                  database_specific: { severity: 'LOW' },
+                  affected: [
+                    {
+                      package: { ecosystem: 'npm', name: 'next' },
+                      ranges: [
+                        {
+                          type: 'SEMVER',
+                          events: [{ introduced: '15.0.0' }, { fixed: '15.2.2' }],
+                        },
+                      ],
+                    },
+                    {
+                      package: { ecosystem: 'npm', name: 'next' },
+                      ranges: [
+                        {
+                          type: 'SEMVER',
+                          events: [{ introduced: '13.0' }, { fixed: '14.2.30' }],
+                        },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        ]),
+      )
+
+      const result = await analyzeDependencyTree('next', '14.2.5')
+
+      expect(result.vulnerablePackages).toHaveLength(1)
+      expect(result.vulnerablePackages[0]?.vulnerabilities[0]?.fixedIn).toBe('14.2.30')
+    })
+
     it('extracts correct fixedIn for prerelease versions (e.g., 16.0.0-beta.0)', async () => {
       const mockResolved = new Map([
         [
@@ -987,4 +1113,386 @@ describe('dependency-analysis', () => {
       expect(result.totalPackages).toBe(3)
     })
   })
+
+  describe('Socket merging', () => {
+    const mockResolved = new Map([
+      [
+        'root@1.0.0',
+        {
+          name: 'root',
+          version: '1.0.0',
+          size: 1000,
+          optional: false,
+          depth: 'root' as const,
+          path: ['root@1.0.0'],
+          tarballUrl: 'https://example.com/root-1.0.0.tgz',
+        },
+      ],
+      [
+        'dep-a@2.0.0',
+        {
+          name: 'dep-a',
+          version: '2.0.0',
+          size: 500,
+          optional: false,
+          depth: 'direct' as const,
+          path: ['root@1.0.0', 'dep-a@2.0.0'],
+          tarballUrl: 'https://example.com/dep-a-2.0.0.tgz',
+        },
+      ],
+    ])
+
+    beforeEach(() => {
+      vi.mocked(resolveDependencyTree).mockResolvedValue(mockResolved)
+    })
+
+    it('merges findings for the same GHSA into one entry tagged with both sources', async () => {
+      mockOsvApi(
+        [{ vulns: [{ id: 'GHSA-shared-0001', modified: '2024-01-01' }] }, { vulns: [] }],
+        new Map([
+          [
+            'root@1.0.0',
+            {
+              vulns: [
+                {
+                  id: 'GHSA-shared-0001',
+                  summary: 'Shared vuln',
+                  aliases: ['CVE-2024-1111'],
+                  database_specific: { severity: 'HIGH' },
+                },
+              ],
+            },
+          ],
+        ]),
+      )
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'root@1.0.0',
+            [
+              {
+                id: 'GHSA-shared-0001',
+                ghsaId: 'GHSA-shared-0001',
+                summary: 'Shared vuln (socket)',
+                severity: 'high' as const,
+                reachability: 'reachable' as const,
+                url: 'https://github.com/advisories/GHSA-shared-0001',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+
+      expect(result.sourceStatus).toEqual({ osv: 'ok', socket: 'ok' })
+      expect(result.vulnerablePackages).toHaveLength(1)
+      const vulns = result.vulnerablePackages[0]!.vulnerabilities
+      expect(vulns).toHaveLength(1)
+      expect(vulns[0]).toMatchObject({
+        id: 'GHSA-shared-0001',
+        sources: ['osv', 'socket'],
+        reachability: 'reachable',
+      })
+      // deduplicated: counted once
+      expect(result.totalCounts).toEqual({ total: 1, critical: 0, high: 1, moderate: 0, low: 0 })
+    })
+
+    it('merges by CVE alias when Socket only has a CVE id', async () => {
+      mockOsvApi(
+        [{ vulns: [{ id: 'GHSA-alias-0001', modified: '2024-01-01' }] }, { vulns: [] }],
+        new Map([
+          [
+            'root@1.0.0',
+            {
+              vulns: [
+                {
+                  id: 'GHSA-alias-0001',
+                  summary: 'Aliased vuln',
+                  aliases: ['CVE-2024-2222'],
+                  database_specific: { severity: 'MODERATE' },
+                },
+              ],
+            },
+          ],
+        ]),
+      )
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'root@1.0.0',
+            [
+              {
+                id: 'CVE-2024-2222',
+                cveId: 'CVE-2024-2222',
+                summary: 'Aliased vuln (socket)',
+                severity: 'moderate' as const,
+                url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-2222',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+      const vulns = result.vulnerablePackages[0]!.vulnerabilities
+      expect(vulns).toHaveLength(1)
+      expect(vulns[0]!.sources).toEqual(['osv', 'socket'])
+    })
+
+    it('adds Socket-only findings as new entries and packages', async () => {
+      mockOsvApi([{ vulns: [] }, { vulns: [] }])
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'dep-a@2.0.0',
+            [
+              {
+                id: 'GHSA-sock-0001',
+                ghsaId: 'GHSA-sock-0001',
+                summary: 'Socket-only vuln',
+                severity: 'critical' as const,
+                fixedIn: '2.1.0',
+                url: 'https://github.com/advisories/GHSA-sock-0001',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+
+      expect(result.vulnerablePackages).toHaveLength(1)
+      const pkg = result.vulnerablePackages[0]!
+      // depth/path filled in from the resolved tree
+      expect(pkg).toMatchObject({ name: 'dep-a', version: '2.0.0', depth: 'direct' })
+      expect(pkg.path).toEqual(['root@1.0.0', 'dep-a@2.0.0'])
+      expect(pkg.vulnerabilities[0]).toMatchObject({
+        id: 'GHSA-sock-0001',
+        sources: ['socket'],
+        fixedIn: '2.1.0',
+      })
+      expect(pkg.counts).toEqual({ total: 1, critical: 1, high: 0, moderate: 0, low: 0 })
+      expect(result.totalCounts.total).toBe(1)
+    })
+
+    it('merges by exact GHSA even when alias groups join distinct advisories', async () => {
+      // OSV expands aliases to the whole alias group, so two distinct
+      // advisories can cross-list each other's GHSA and CVE ids
+      mockOsvApi(
+        [{ vulns: [{ id: 'GHSA-aaaa-0001', modified: '2024-01-01' }] }, { vulns: [] }],
+        new Map([
+          [
+            'root@1.0.0',
+            {
+              vulns: [
+                {
+                  id: 'GHSA-aaaa-0001',
+                  summary: 'Original advisory',
+                  aliases: ['CVE-2021-0001', 'CVE-2026-0002', 'GHSA-bbbb-0002'],
+                  database_specific: { severity: 'HIGH' },
+                },
+                {
+                  id: 'GHSA-bbbb-0002',
+                  summary: 'Fix-bypass advisory',
+                  aliases: ['CVE-2021-0001', 'CVE-2026-0002', 'GHSA-aaaa-0001'],
+                  database_specific: { severity: 'HIGH' },
+                },
+              ],
+            },
+          ],
+        ]),
+      )
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'root@1.0.0',
+            [
+              {
+                id: 'GHSA-bbbb-0002',
+                ghsaId: 'GHSA-bbbb-0002',
+                cveId: 'CVE-2026-0002',
+                summary: 'Fix-bypass advisory (socket)',
+                severity: 'high' as const,
+                url: 'https://github.com/advisories/GHSA-bbbb-0002',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+      const vulns = result.vulnerablePackages[0]!.vulnerabilities
+      expect(vulns).toHaveLength(2)
+
+      const original = vulns.find(vuln => vuln.id === 'GHSA-aaaa-0001')!
+      const bypass = vulns.find(vuln => vuln.id === 'GHSA-bbbb-0002')!
+      // the Socket finding must land on the advisory it actually names,
+      // not on the sibling whose polluted aliases also match its CVE
+      expect(bypass.sources).toEqual(['osv', 'socket'])
+      expect(bypass.cveId).toBe('CVE-2026-0002')
+      expect(original.sources).toEqual(['osv'])
+      expect(original.cveId).toBeUndefined()
+
+      // reconciliation strips provably-misattributed aliases (the sibling's
+      // primary id, and the CVE the sibling's source paired to itself) and
+      // records them so the UI can attribute the bad data
+      expect(original.aliases).toEqual(['CVE-2021-0001'])
+      expect(original.disputedAliases).toEqual(['CVE-2026-0002', 'GHSA-bbbb-0002'])
+      expect(bypass.aliases).toEqual(['CVE-2021-0001', 'CVE-2026-0002'])
+      expect(bypass.disputedAliases).toEqual(['GHSA-aaaa-0001'])
+    })
+
+    it('never CVE-merges a finding into an entry with a different GHSA id', async () => {
+      mockOsvApi(
+        [{ vulns: [{ id: 'GHSA-aaaa-0001', modified: '2024-01-01' }] }, { vulns: [] }],
+        new Map([
+          [
+            'root@1.0.0',
+            {
+              vulns: [
+                {
+                  id: 'GHSA-aaaa-0001',
+                  summary: 'Existing advisory',
+                  aliases: ['CVE-2024-0001'],
+                  database_specific: { severity: 'HIGH' },
+                },
+              ],
+            },
+          ],
+        ]),
+      )
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'root@1.0.0',
+            [
+              {
+                id: 'GHSA-zzzz-0009',
+                ghsaId: 'GHSA-zzzz-0009',
+                cveId: 'CVE-2024-0001',
+                summary: 'Different advisory sharing a CVE',
+                severity: 'moderate' as const,
+                url: 'https://github.com/advisories/GHSA-zzzz-0009',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+      const vulns = result.vulnerablePackages[0]!.vulnerabilities
+      // a finding that names its own GHSA becomes its own entry rather than
+      // being folded into a different advisory via a shared CVE
+      expect(vulns).toHaveLength(2)
+      expect(vulns.find(vuln => vuln.id === 'GHSA-zzzz-0009')!.sources).toEqual(['socket'])
+      expect(vulns.find(vuln => vuln.id === 'GHSA-aaaa-0001')!.sources).toEqual(['osv'])
+    })
+
+    it('keeps the strongest reachability verdict when duplicate Socket findings merge', async () => {
+      mockOsvApi([{ vulns: [] }, { vulns: [] }])
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'root@1.0.0',
+            [
+              {
+                id: 'GHSA-dupe-0001',
+                ghsaId: 'GHSA-dupe-0001',
+                summary: 'Duplicated advisory',
+                severity: 'high' as const,
+                reachability: 'reachable' as const,
+                url: 'https://github.com/advisories/GHSA-dupe-0001',
+              },
+              {
+                id: 'GHSA-dupe-0001',
+                ghsaId: 'GHSA-dupe-0001',
+                summary: 'Duplicated advisory (second alert)',
+                severity: 'high' as const,
+                reachability: 'unreachable' as const,
+                url: 'https://github.com/advisories/GHSA-dupe-0001',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+      const vulns = result.vulnerablePackages[0]!.vulnerabilities
+      expect(vulns).toHaveLength(1)
+      // 'reachable' must not be downgraded by the later 'unreachable' verdict
+      expect(vulns[0]!.reachability).toBe('reachable')
+    })
+
+    it('ignores Socket findings for packages outside the resolved tree', async () => {
+      mockOsvApi([{ vulns: [] }, { vulns: [] }])
+
+      mockSocketScan({
+        status: 'ok',
+        vulnerabilities: new Map([
+          [
+            'unknown-pkg@9.9.9',
+            [
+              {
+                id: 'GHSA-unknown-0001',
+                summary: 'Not in tree',
+                severity: 'high' as const,
+                url: 'https://example.com',
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+      expect(result.vulnerablePackages).toHaveLength(0)
+    })
+
+    it('builds supply-chain packages with depth and path from the tree', async () => {
+      mockOsvApi([{ vulns: [] }, { vulns: [] }])
+
+      mockSocketScan({
+        status: 'ok',
+        supplyChainAlerts: new Map([
+          [
+            'dep-a@2.0.0',
+            [
+              {
+                type: 'installScripts' as const,
+                severity: 'low' as const,
+                url: 'https://socket.dev/npm/package/dep-a',
+                sources: ['socket' as const],
+              },
+              {
+                type: 'malware' as const,
+                severity: 'critical' as const,
+                url: 'https://socket.dev/npm/package/dep-a',
+                sources: ['socket' as const],
+              },
+            ],
+          ],
+        ]),
+      })
+
+      const result = await analyzeDependencyTree('root', '1.0.0')
+
+      expect(result.supplyChainPackages).toHaveLength(1)
+      const pkg = result.supplyChainPackages[0]!
+      expect(pkg).toMatchObject({ name: 'dep-a', version: '2.0.0', depth: 'direct' })
+      // alerts sorted by severity (critical first)
+      expect(pkg.alerts.map(alert => alert.type)).toEqual(['malware', 'installScripts'])
+    })
+  })
 })
diff --git a/test/unit/server/utils/osv.spec.ts b/test/unit/server/utils/osv.spec.ts
new file mode 100644
index 0000000000..228651a17a
--- /dev/null
+++ b/test/unit/server/utils/osv.spec.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+const $fetchMock = vi.fn()
+vi.stubGlobal('$fetch', $fetchMock)
+
+const { fetchOsvVulnerabilityCount } = await import('#server/utils/osv')
+
+describe('osv', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('fetchOsvVulnerabilityCount', () => {
+    it('returns the number of vulnerabilities', async () => {
+      $fetchMock.mockResolvedValue({
+        vulns: [
+          { id: 'GHSA-aaaa-bbbb-cccc', modified: '2024-01-01' },
+          { id: 'GHSA-dddd-eeee-ffff', modified: '2024-01-02' },
+        ],
+      })
+
+      await expect(fetchOsvVulnerabilityCount('test-pkg', '1.0.0')).resolves.toBe(2)
+    })
+
+    it('returns 0 when no vulnerabilities are found', async () => {
+      $fetchMock.mockResolvedValue({})
+
+      await expect(fetchOsvVulnerabilityCount('test-pkg', '1.0.0')).resolves.toBe(0)
+    })
+
+    it('returns null (not 0) when the query fails', async () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      $fetchMock.mockRejectedValue(new Error('OSV API error'))
+
+      await expect(fetchOsvVulnerabilityCount('test-pkg', '1.0.0')).resolves.toBeNull()
+    })
+  })
+})
diff --git a/test/unit/server/utils/socket.spec.ts b/test/unit/server/utils/socket.spec.ts
new file mode 100644
index 0000000000..6ba7ed9a1a
--- /dev/null
+++ b/test/unit/server/utils/socket.spec.ts
@@ -0,0 +1,448 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+/** The subset of the batch-purl request options the tests assert against */
+interface SocketRequest {
+  method: string
+  timeout?: number
+  headers: { authorization: string; accept: string }
+  body: { components: Array<{ purl: string }> }
+  responseType: string
+}
+
+const $fetchMock = vi.fn<(url: string, options: SocketRequest) => Promise<string>>()
+vi.stubGlobal('$fetch', $fetchMock)
+
+/** Retrieve a recorded $fetch call, failing loudly if it never happened
+ * (instead of a non-null assertion that hides a missing call) */
+function fetchCall(index: number): [string, SocketRequest] {
+  const call = $fetchMock.mock.calls[index]
+  if (!call) throw new Error(`expected a $fetch call at index ${index}, but none was recorded`)
+  return call
+}
+
+let runtimeConfig: { socket: { apiKey: string; orgSlug: string }; public: Record<string, unknown> }
+vi.stubGlobal('useRuntimeConfig', () => runtimeConfig)
+
+// in-memory stand-in for Nitro's `cache` storage, so the per-purl cache is
+// exercised; cleared per test for isolation. The fail flags simulate a storage
+// driver outage so the graceful-degradation paths can be asserted.
+const cacheStore = new Map<string, unknown>()
+let failCacheRead = false
+let failCacheWrite = false
+vi.stubGlobal('useStorage', () => ({
+  getItem: async (key: string) => (cacheStore.has(key) ? cacheStore.get(key) : null),
+  setItem: async (key: string, value: unknown) => {
+    cacheStore.set(key, value)
+  },
+  getItems: async (keys: string[]) => {
+    if (failCacheRead) throw new Error('cache storage unavailable')
+    return keys.map(key => ({ key, value: cacheStore.has(key) ? cacheStore.get(key) : null }))
+  },
+  setItems: async (items: Array<{ key: string; value: unknown }>) => {
+    if (failCacheWrite) throw new Error('cache storage unavailable')
+    for (const { key, value } of items) cacheStore.set(key, value)
+  },
+}))
+
+/** Fresh module per test: resets the quota circuit-breaker state */
+async function importSocket() {
+  vi.resetModules()
+  return await import('#server/utils/socket')
+}
+
+function configureSocket() {
+  runtimeConfig = {
+    socket: { apiKey: 'test-key', orgSlug: 'test-org' },
+    public: {},
+  }
+}
+
+const PACKAGES = [{ name: 'vuln-pkg', version: '1.0.0' }]
+
+describe('socket', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    cacheStore.clear()
+    failCacheRead = false
+    failCacheWrite = false
+    runtimeConfig = { socket: { apiKey: '', orgSlug: '' }, public: {} }
+  })
+
+  describe('toNpmPurl', () => {
+    it('builds purls for plain and scoped packages', async () => {
+      const { toNpmPurl } = await importSocket()
+      expect(toNpmPurl('lodash', '4.17.21')).toBe('pkg:npm/lodash@4.17.21')
+      expect(toNpmPurl('@babel/core', '7.0.0')).toBe('pkg:npm/%40babel/core@7.0.0')
+    })
+  })
+
+  describe('querySocketForTree', () => {
+    it('reports unconfigured without an API key and makes no requests', async () => {
+      const { querySocketForTree } = await importSocket()
+      const scan = await querySocketForTree(PACKAGES)
+
+      expect(scan.status).toBe('unconfigured')
+      expect(scan.vulnerabilities.size).toBe(0)
+      expect(scan.supplyChainAlerts.size).toBe(0)
+      expect($fetchMock).not.toHaveBeenCalled()
+    })
+
+    it('reports unconfigured (no request) when only one of key/slug is set', async () => {
+      runtimeConfig = { socket: { apiKey: 'key', orgSlug: '' }, public: {} }
+      const { querySocketForTree } = await importSocket()
+      const scan = await querySocketForTree(PACKAGES)
+
+      expect(scan.status).toBe('unconfigured')
+      expect($fetchMock).not.toHaveBeenCalled()
+    })
+
+    it('keeps valid artifacts when a later ndjson line is malformed', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      const artifact = {
+        type: 'npm',
+        name: 'vuln-pkg',
+        version: '1.0.0',
+        alerts: [{ key: 'a', type: 'cve', severity: 'high', props: { ghsaId: 'GHSA-x' } }],
+      }
+      // a truncated/garbled trailing line must not discard the whole chunk
+      $fetchMock.mockResolvedValue(`${JSON.stringify(artifact)}\n{ "type": "npm", "name":`)
+
+      const scan = await querySocketForTree(PACKAGES)
+
+      expect(scan.status).toBe('ok')
+      expect(scan.vulnerabilities.has('vuln-pkg@1.0.0')).toBe(true)
+    })
+
+    it('normalizes vulnerability and supply-chain alerts from an ndjson response', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      const artifact = {
+        type: 'npm',
+        name: 'vuln-pkg',
+        version: '1.0.0',
+        alerts: [
+          {
+            key: 'alert-1',
+            type: 'cve',
+            severity: 'high',
+            category: 'vulnerability',
+            props: {
+              ghsaId: 'GHSA-aaaa-bbbb-cccc',
+              cveId: 'CVE-2024-12345',
+              title: 'Bad vulnerability',
+              firstPatchedVersionIdentifier: '1.2.3',
+              reachability: 'unreachable',
+            },
+          },
+          {
+            key: 'alert-2',
+            type: 'mediumCVE',
+            // the Socket API schema has used 'middle' for medium severity
+            severity: 'middle',
+            category: 'vulnerability',
+            props: {},
+          },
+          {
+            key: 'alert-3',
+            type: 'malware',
+            severity: 'critical',
+            category: 'supplyChainRisk',
+            props: {},
+          },
+          // not in the curated allowlists - ignored
+          { key: 'alert-4', type: 'usesEval', severity: 'low', props: {} },
+          // synthetic alert - ignored
+          { key: 'alert-5', type: 'pendingScan', severity: 'low', props: {} },
+        ],
+      }
+      $fetchMock.mockResolvedValue(`${JSON.stringify(artifact)}\n`)
+
+      const scan = await querySocketForTree(PACKAGES)
+
+      expect(scan.status).toBe('ok')
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+      const [url, options] = fetchCall(0)
+      expect(url).toBe('https://api.socket.dev/v0/orgs/test-org/purl?alerts=true')
+      expect(options.headers.authorization).toBe('Bearer test-key')
+      expect(options.body.components).toEqual([{ purl: 'pkg:npm/vuln-pkg@1.0.0' }])
+
+      const findings = scan.vulnerabilities.get('vuln-pkg@1.0.0')!
+      expect(findings).toHaveLength(2)
+      expect(findings[0]).toMatchObject({
+        id: 'GHSA-aaaa-bbbb-cccc',
+        ghsaId: 'GHSA-aaaa-bbbb-cccc',
+        cveId: 'CVE-2024-12345',
+        summary: 'Bad vulnerability',
+        severity: 'high',
+        fixedIn: '1.2.3',
+        reachability: 'unreachable',
+        url: 'https://github.com/advisories/GHSA-aaaa-bbbb-cccc',
+      })
+      // no GHSA/CVE id: synthetic id, socket.dev url, 'middle' -> moderate
+      expect(findings[1]).toMatchObject({
+        id: 'SOCKET-alert-2',
+        severity: 'moderate',
+        url: 'https://socket.dev/npm/package/vuln-pkg',
+      })
+
+      const alerts = scan.supplyChainAlerts.get('vuln-pkg@1.0.0')!
+      expect(alerts).toEqual([
+        {
+          type: 'malware',
+          severity: 'critical',
+          url: 'https://socket.dev/npm/package/vuln-pkg',
+          sources: ['socket'],
+        },
+      ])
+    })
+
+    it('parses a JSON array response and scoped artifact names', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      $fetchMock.mockResolvedValue(
+        JSON.stringify([
+          {
+            type: 'npm',
+            name: 'core',
+            namespace: '@babel',
+            version: '7.0.0',
+            alerts: [
+              {
+                key: 'a',
+                type: 'cve',
+                severity: 'critical',
+                props: { ghsaId: 'GHSA-1111-2222-3333' },
+              },
+            ],
+          },
+        ]),
+      )
+
+      const scan = await querySocketForTree([{ name: '@babel/core', version: '7.0.0' }])
+      expect(scan.vulnerabilities.has('@babel/core@7.0.0')).toBe(true)
+    })
+
+    it('extracts reachability from artifact alertKeysToReachabilityTypes', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      $fetchMock.mockResolvedValue(
+        JSON.stringify([
+          {
+            type: 'npm',
+            name: 'vuln-pkg',
+            version: '1.0.0',
+            alerts: [{ key: 'k1', type: 'cve', severity: 'high', props: { ghsaId: 'GHSA-x' } }],
+            alertKeysToReachabilityTypes: { k1: ['unreachable', 'maybe_reachable'] },
+          },
+        ]),
+      )
+
+      const scan = await querySocketForTree(PACKAGES)
+      // strongest verdict wins: maybe_reachable > unreachable
+      expect(scan.vulnerabilities.get('vuln-pkg@1.0.0')![0]!.reachability).toBe('maybe_reachable')
+    })
+
+    it('deduplicates repeated supply-chain alert types for the same package', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      $fetchMock.mockResolvedValue(
+        JSON.stringify([
+          {
+            type: 'npm',
+            name: 'vuln-pkg',
+            version: '1.0.0',
+            alerts: [
+              { key: 'a', type: 'installScripts', severity: 'low', props: { file: 'a.js' } },
+              { key: 'b', type: 'installScripts', severity: 'low', props: { file: 'b.js' } },
+            ],
+          },
+        ]),
+      )
+
+      const scan = await querySocketForTree(PACKAGES)
+      expect(scan.supplyChainAlerts.get('vuln-pkg@1.0.0')).toHaveLength(1)
+    })
+
+    it('chunks requests above the batch limit', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      $fetchMock.mockResolvedValue('[]')
+      const manyPackages = Array.from({ length: 1500 }, (_, i) => ({
+        name: `pkg-${i}`,
+        version: '1.0.0',
+      }))
+
+      const scan = await querySocketForTree(manyPackages)
+      expect(scan.status).toBe('ok')
+      expect($fetchMock).toHaveBeenCalledTimes(2)
+      expect(fetchCall(0)[1].body.components).toHaveLength(1024)
+      expect(fetchCall(1)[1].body.components).toHaveLength(476)
+    })
+
+    it('reports failed on request errors', async () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      $fetchMock.mockRejectedValue(new Error('network error'))
+
+      const scan = await querySocketForTree(PACKAGES)
+      expect(scan.status).toBe('failed')
+    })
+
+    it('reports partial when some chunks succeed and others fail', async () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      // first chunk (1024) returns a finding, second chunk (network) fails
+      const artifact = {
+        type: 'npm',
+        name: 'pkg-0',
+        version: '1.0.0',
+        alerts: [{ key: 'a', type: 'cve', severity: 'high', props: { ghsaId: 'GHSA-x' } }],
+      }
+      let call = 0
+      $fetchMock.mockImplementation(async () => {
+        call++
+        if (call === 1) return `${JSON.stringify(artifact)}\n`
+        throw new Error('network error')
+      })
+      const manyPackages = Array.from({ length: 1500 }, (_, i) => ({
+        name: `pkg-${i}`,
+        version: '1.0.0',
+      }))
+
+      const scan = await querySocketForTree(manyPackages)
+      expect(scan.status).toBe('partial')
+      expect(scan.vulnerabilities.has('pkg-0@1.0.0')).toBe(true)
+    })
+
+    it('trips the circuit breaker on quota errors', async () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      $fetchMock.mockRejectedValue(Object.assign(new Error('quota exceeded'), { statusCode: 429 }))
+
+      const first = await querySocketForTree(PACKAGES)
+      expect(first.status).toBe('unavailable')
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+
+      // While the breaker is open, no further requests are attempted
+      const second = await querySocketForTree(PACKAGES)
+      expect(second.status).toBe('unavailable')
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+    })
+
+    it('reports ok for an empty package list without requests', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      const scan = await querySocketForTree([])
+      expect(scan.status).toBe('ok')
+      expect($fetchMock).not.toHaveBeenCalled()
+    })
+
+    it('caches findings per purl so a repeat scan makes no request', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+
+      const artifact = {
+        type: 'npm',
+        name: 'vuln-pkg',
+        version: '1.0.0',
+        alerts: [{ key: 'a', type: 'cve', severity: 'high', props: { ghsaId: 'GHSA-x' } }],
+      }
+      $fetchMock.mockResolvedValue(`${JSON.stringify(artifact)}\n`)
+
+      const first = await querySocketForTree(PACKAGES)
+      expect(first.vulnerabilities.has('vuln-pkg@1.0.0')).toBe(true)
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+
+      const second = await querySocketForTree(PACKAGES)
+      expect(second.status).toBe('ok')
+      expect(second.vulnerabilities.has('vuln-pkg@1.0.0')).toBe(true)
+      // served entirely from the per-purl cache
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+    })
+
+    it('requests only the purls an overlapping tree has not cached yet', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+      $fetchMock.mockResolvedValue('[]')
+
+      await querySocketForTree([
+        { name: 'a', version: '1.0.0' },
+        { name: 'b', version: '1.0.0' },
+      ])
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+      expect(fetchCall(0)[1].body.components).toHaveLength(2)
+
+      await querySocketForTree([
+        { name: 'b', version: '1.0.0' },
+        { name: 'c', version: '1.0.0' },
+      ])
+      expect($fetchMock).toHaveBeenCalledTimes(2)
+      // only the uncached `c` is re-requested; `b` is reused
+      expect(fetchCall(1)[1].body.components).toEqual([{ purl: 'pkg:npm/c@1.0.0' }])
+    })
+
+    it('caches alert-free packages so they are not re-queried', async () => {
+      configureSocket()
+      const { querySocketForTree } = await importSocket()
+      $fetchMock.mockResolvedValue('[]')
+
+      await querySocketForTree(PACKAGES)
+      await querySocketForTree(PACKAGES)
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+    })
+
+    it('degrades to a direct Socket query when the cache read fails', async () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      configureSocket()
+      failCacheRead = true
+      const { querySocketForTree } = await importSocket()
+
+      const artifact = {
+        type: 'npm',
+        name: 'vuln-pkg',
+        version: '1.0.0',
+        alerts: [{ key: 'a', type: 'cve', severity: 'high', props: { ghsaId: 'GHSA-x' } }],
+      }
+      $fetchMock.mockResolvedValue(`${JSON.stringify(artifact)}\n`)
+
+      // a cache-storage outage must not fail the scan: every purl becomes a miss
+      const scan = await querySocketForTree(PACKAGES)
+      expect(scan.status).toBe('ok')
+      expect(scan.vulnerabilities.has('vuln-pkg@1.0.0')).toBe(true)
+      expect($fetchMock).toHaveBeenCalledTimes(1)
+    })
+
+    it('keeps fetched findings when the cache write fails', async () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => {})
+      configureSocket()
+      failCacheWrite = true
+      const { querySocketForTree } = await importSocket()
+
+      const artifact = {
+        type: 'npm',
+        name: 'vuln-pkg',
+        version: '1.0.0',
+        alerts: [{ key: 'a', type: 'cve', severity: 'high', props: { ghsaId: 'GHSA-x' } }],
+      }
+      $fetchMock.mockResolvedValue(`${JSON.stringify(artifact)}\n`)
+
+      const scan = await querySocketForTree(PACKAGES)
+      expect(scan.status).toBe('ok')
+      expect(scan.vulnerabilities.has('vuln-pkg@1.0.0')).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/shared/utils/security-sources.spec.ts b/test/unit/shared/utils/security-sources.spec.ts
new file mode 100644
index 0000000000..c7b62a0f9d
--- /dev/null
+++ b/test/unit/shared/utils/security-sources.spec.ts
@@ -0,0 +1,276 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  PackageVulnerabilityInfo,
+  VulnerabilityTreeResult,
+} from '#shared/types/dependency-analysis'
+import {
+  filterVulnerabilityTreeBySources,
+  hasTransientSourceFailure,
+  noEnabledSecuritySourceHasData,
+  securitySourceHasData,
+  selectPreviewVulnerabilities,
+} from '#shared/utils/security-sources'
+
+function makeVuln(
+  id: string,
+  severity: PackageVulnerabilityInfo['vulnerabilities'][number]['severity'],
+  sources: PackageVulnerabilityInfo['vulnerabilities'][number]['sources'],
+): PackageVulnerabilityInfo['vulnerabilities'][number] {
+  return {
+    id,
+    summary: `Summary for ${id}`,
+    severity,
+    aliases: [],
+    url: `https://osv.dev/vulnerability/${id}`,
+    sources,
+  }
+}
+
+function makeTree(vulnerablePackages: PackageVulnerabilityInfo[]): VulnerabilityTreeResult {
+  const totalCounts = { total: 0, critical: 0, high: 0, moderate: 0, low: 0 }
+  for (const pkg of vulnerablePackages) {
+    totalCounts.total += pkg.counts.total
+    totalCounts.critical += pkg.counts.critical
+    totalCounts.high += pkg.counts.high
+    totalCounts.moderate += pkg.counts.moderate
+    totalCounts.low += pkg.counts.low
+  }
+  return {
+    package: 'root-pkg',
+    version: '1.0.0',
+    vulnerablePackages,
+    supplyChainPackages: [],
+    deprecatedPackages: [],
+    totalPackages: 10,
+    failedQueries: 0,
+    totalCounts,
+    sourceStatus: { osv: 'ok', socket: 'unconfigured' },
+  }
+}
+
+describe('noEnabledSecuritySourceHasData', () => {
+  const allEnabled = { osv: true, socket: true }
+
+  it('is false when an enabled source succeeded', () => {
+    expect(noEnabledSecuritySourceHasData({ osv: 'ok', socket: 'unconfigured' }, allEnabled)).toBe(
+      false,
+    )
+    expect(noEnabledSecuritySourceHasData({ osv: 'partial', socket: 'failed' }, allEnabled)).toBe(
+      false,
+    )
+  })
+
+  it('is true when no enabled source produced data', () => {
+    expect(noEnabledSecuritySourceHasData({ osv: 'failed', socket: 'failed' }, allEnabled)).toBe(
+      true,
+    )
+    // unconfigured/unavailable sources carry no data either
+    expect(
+      noEnabledSecuritySourceHasData({ osv: 'failed', socket: 'unconfigured' }, allEnabled),
+    ).toBe(true)
+    expect(
+      noEnabledSecuritySourceHasData({ osv: 'failed', socket: 'unavailable' }, allEnabled),
+    ).toBe(true)
+  })
+
+  it("ignores an 'ok' status from a disabled source", () => {
+    // the user's only enabled source failed; the disabled source's success
+    // must not mask the failure
+    expect(
+      noEnabledSecuritySourceHasData({ osv: 'failed', socket: 'ok' }, { osv: true, socket: false }),
+    ).toBe(true)
+    expect(
+      noEnabledSecuritySourceHasData(
+        { osv: 'ok', socket: 'unavailable' },
+        { osv: false, socket: true },
+      ),
+    ).toBe(true)
+  })
+
+  it('is false for an empty status record or no enabled sources', () => {
+    expect(noEnabledSecuritySourceHasData({}, allEnabled)).toBe(false)
+    expect(noEnabledSecuritySourceHasData({ osv: 'failed' }, { osv: false, socket: false })).toBe(
+      false,
+    )
+  })
+})
+
+describe('hasTransientSourceFailure', () => {
+  it('is true for failed, unavailable, or partial (degraded) sources', () => {
+    expect(hasTransientSourceFailure({ osv: 'ok', socket: 'unavailable' })).toBe(true)
+    expect(hasTransientSourceFailure({ osv: 'failed', socket: 'ok' })).toBe(true)
+    // a partial scan is degraded, so it must not be cached for the full hour
+    expect(hasTransientSourceFailure({ osv: 'partial', socket: 'unconfigured' })).toBe(true)
+  })
+
+  it('is false for complete or stably-unconfigured results', () => {
+    expect(hasTransientSourceFailure({ osv: 'ok', socket: 'ok' })).toBe(false)
+    expect(hasTransientSourceFailure({ osv: 'ok', socket: 'unconfigured' })).toBe(false)
+  })
+})
+
+describe('securitySourceHasData', () => {
+  it('is true only when the source succeeded fully or partially', () => {
+    expect(securitySourceHasData({ socket: 'ok' }, 'socket')).toBe(true)
+    expect(securitySourceHasData({ socket: 'partial' }, 'socket')).toBe(true)
+  })
+
+  it('is false when the source is unconfigured, unavailable, failed, or absent', () => {
+    expect(securitySourceHasData({ socket: 'unconfigured' }, 'socket')).toBe(false)
+    expect(securitySourceHasData({ socket: 'unavailable' }, 'socket')).toBe(false)
+    expect(securitySourceHasData({ socket: 'failed' }, 'socket')).toBe(false)
+    expect(securitySourceHasData({ osv: 'ok' }, 'socket')).toBe(false)
+  })
+})
+
+describe('filterVulnerabilityTreeBySources', () => {
+  const pkg: PackageVulnerabilityInfo = {
+    name: 'vuln-pkg',
+    version: '2.0.0',
+    depth: 'direct',
+    path: ['root-pkg@1.0.0', 'vuln-pkg@2.0.0'],
+    vulnerabilities: [
+      makeVuln('GHSA-aaaa-aaaa-aaaa', 'critical', ['osv']),
+      makeVuln('GHSA-bbbb-bbbb-bbbb', 'low', ['osv']),
+    ],
+    counts: { total: 2, critical: 1, high: 0, moderate: 0, low: 1 },
+  }
+
+  it('passes the tree through unchanged when all sources are enabled', () => {
+    const tree = makeTree([pkg])
+    const filtered = filterVulnerabilityTreeBySources(tree, { osv: true })
+    expect(filtered.vulnerablePackages).toHaveLength(1)
+    expect(filtered.vulnerablePackages[0]).toBe(pkg)
+    expect(filtered.totalCounts).toEqual(tree.totalCounts)
+  })
+
+  it('removes all findings when every source is disabled', () => {
+    const tree = makeTree([pkg])
+    const filtered = filterVulnerabilityTreeBySources(tree, { osv: false })
+    expect(filtered.vulnerablePackages).toHaveLength(0)
+    expect(filtered.totalCounts).toEqual({ total: 0, critical: 0, high: 0, moderate: 0, low: 0 })
+  })
+
+  it('recomputes counts when only some findings remain', () => {
+    const mixedPkg: PackageVulnerabilityInfo = {
+      ...pkg,
+      vulnerabilities: [
+        makeVuln('GHSA-cccc-cccc-cccc', 'critical', ['osv']),
+        makeVuln('UNKNOWN-1', 'unknown', ['osv']),
+      ],
+      counts: { total: 2, critical: 1, high: 0, moderate: 0, low: 0 },
+    }
+    const tree = makeTree([mixedPkg])
+    const filtered = filterVulnerabilityTreeBySources(tree, { osv: true })
+    // unknown severities count toward the total but no severity bucket
+    expect(filtered.totalCounts).toEqual({ total: 2, critical: 1, high: 0, moderate: 0, low: 0 })
+  })
+
+  it('preserves deprecated packages and scan metadata', () => {
+    const tree = makeTree([pkg])
+    tree.deprecatedPackages = [
+      {
+        name: 'old-pkg',
+        version: '0.1.0',
+        depth: 'transitive',
+        path: [],
+        message: 'use something else',
+      },
+    ]
+    const filtered = filterVulnerabilityTreeBySources(tree, { osv: false })
+    expect(filtered.deprecatedPackages).toEqual(tree.deprecatedPackages)
+    expect(filtered.totalPackages).toBe(tree.totalPackages)
+    expect(filtered.sourceStatus).toEqual(tree.sourceStatus)
+  })
+
+  it('keeps multi-source findings when any of their sources is enabled', () => {
+    const mergedPkg: PackageVulnerabilityInfo = {
+      ...pkg,
+      vulnerabilities: [
+        makeVuln('GHSA-both-0001', 'high', ['osv', 'socket']),
+        makeVuln('GHSA-osv-0002', 'low', ['osv']),
+      ],
+      counts: { total: 2, critical: 0, high: 1, moderate: 0, low: 1 },
+    }
+    const tree = makeTree([mergedPkg])
+
+    const socketOnly = filterVulnerabilityTreeBySources(tree, { osv: false, socket: true })
+    expect(socketOnly.vulnerablePackages).toHaveLength(1)
+    expect(socketOnly.vulnerablePackages[0]!.vulnerabilities.map(v => v.id)).toEqual([
+      'GHSA-both-0001',
+    ])
+    expect(socketOnly.totalCounts).toEqual({ total: 1, critical: 0, high: 1, moderate: 0, low: 0 })
+  })
+
+  it('filters supply-chain alerts by source', () => {
+    const tree = makeTree([])
+    tree.supplyChainPackages = [
+      {
+        name: 'sketchy-pkg',
+        version: '1.0.0',
+        depth: 'direct',
+        path: [],
+        alerts: [
+          {
+            type: 'malware',
+            severity: 'critical',
+            url: 'https://socket.dev/npm/package/sketchy-pkg',
+            sources: ['socket'],
+          },
+        ],
+      },
+    ]
+
+    const enabled = filterVulnerabilityTreeBySources(tree, { osv: true, socket: true })
+    expect(enabled.supplyChainPackages).toHaveLength(1)
+
+    const disabled = filterVulnerabilityTreeBySources(tree, { osv: true, socket: false })
+    expect(disabled.supplyChainPackages).toHaveLength(0)
+  })
+})
+
+describe('selectPreviewVulnerabilities', () => {
+  it('returns the list unchanged when it fits the limit', () => {
+    const vulns = [makeVuln('GHSA-a', 'high', ['osv']), makeVuln('GHSA-b', 'low', ['socket'])]
+    expect(selectPreviewVulnerabilities(vulns, 2)).toEqual(vulns)
+  })
+
+  it('guarantees a representative for a source below the fold', () => {
+    const vulns = [
+      makeVuln('GHSA-a', 'critical', ['osv']),
+      makeVuln('GHSA-b', 'high', ['osv']),
+      makeVuln('GHSA-c', 'low', ['socket']),
+    ]
+    // a plain slice would show two OSV rows and hide Socket entirely
+    expect(selectPreviewVulnerabilities(vulns, 2).map(vuln => vuln.id)).toEqual([
+      'GHSA-a',
+      'GHSA-c',
+    ])
+  })
+
+  it('lets a merged finding represent all of its sources', () => {
+    const vulns = [
+      makeVuln('GHSA-a', 'critical', ['osv', 'socket']),
+      makeVuln('GHSA-b', 'high', ['osv']),
+      makeVuln('GHSA-c', 'low', ['socket']),
+    ]
+    // GHSA-a already covers both sources, so the remaining slot goes to
+    // the next finding by severity
+    expect(selectPreviewVulnerabilities(vulns, 2).map(vuln => vuln.id)).toEqual([
+      'GHSA-a',
+      'GHSA-b',
+    ])
+  })
+
+  it('preserves severity order in the preview', () => {
+    const vulns = [
+      makeVuln('GHSA-a', 'critical', ['socket']),
+      makeVuln('GHSA-b', 'high', ['osv']),
+      makeVuln('GHSA-c', 'low', ['osv']),
+    ]
+    expect(selectPreviewVulnerabilities(vulns, 2).map(vuln => vuln.id)).toEqual([
+      'GHSA-a',
+      'GHSA-b',
+    ])
+  })
+})